The HTTP parser in Node.js historically accepted spaces inside the numeric value of the Content-Length header — for example, treating "Content-Length: 1 2" as the decimal value 12 — a behavior that contradicts the HTTP specification and was catalogued as CVE‑2018‑7159; Node.js maintainers...