HTTP Request Smuggling via Empty headers separated by CR

This report was originally submitted here: https://hackerone.com/reports/2001873

const http = require("http");
http
  .createServer((request, response) => {
    let body = [];
    request
      .on("error", (err) => {
        response.end("Request Error: " + err);
      })
      .on("data", (chunk) => {
        body.push(chunk);
      })
      .on("end", () => {
        body = …