Mongoose separates HTTP header names from values incorrectly

[kenballus]

The HTTP standards specify that header names and values are separated by a colon. Mongoose allows them to be separated by whitespace. This is a potential vector for HTTP request smuggling.

For example, Mongoose will misinterpret the following request:

GET / HTTP/1.1\r\nContent-Length 10\r\n\r\n0123456789

Because Mongoose does not enforce that header names and values be separated by a colon, Mongoose misinterprets this request as having a Content-Length header, so it sees 0123456789 as the request's body. A standards-compliant HTTP server would reject the message because it contains an invalid header.