CVE-2026-40073: Unvalidated Content Length Limit Bypass

When an HTTP stream handler accumulates payload size and checks it against a `content-length` limit parsed with `Number()`, `parseInt()`, or `parseFloat()`, it can fail open. For chunked requests, missing headers cause these parsers to return `NaN`. Because numeric inequalities evaluate to false against `NaN` (e.g., `size > NaN`), an attacker can circumvent

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0JS
greprules fetch cve-2026-40073-unvalidated-content-length-limit-bypass --engine opengrep

Description

When an HTTP stream handler accumulates payload size and checks it against a `content-length` limit parsed with `Number()`, `parseInt()`, or `parseFloat()`, it can fail open. For chunked requests, missing headers cause these parsers to return `NaN`. Because numeric inequalities evaluate to false against `NaN` (e.g., `size > NaN`), an attacker can circumvent