# HTTP header values do not have trailing OWS trimmed

http_parser does not trim trailing OWS from header values, so a Host with trailing space bypasses Envoy domain blocklists and tunnels requests to blocked hosts.

- Payout: hidden
- Severity: high
- Program: Node.js
- Found by: alyssawilk
- Disclosed: 2020-02-24
- CVE: CVE-2019-15606
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/730779
- Library page: https://bugbountylibrary.com/r/h1%3A730779
- Tags: area:devices domain:network impact:internal-access kind:bounty platform:hackerone sev:high tech:nodejs technique:parser-differential vuln:access-control vuln:host-header vuln:misconfiguration

**Target:** http_parser header value parsing (Host header)
**Root cause:** http_parser passes header values through without trimming trailing linear whitespace (OWS/LWS), so 'foo.com ' differs from 'foo.com' despite the HTTP spec allowing optional trailing whitespace.
**Steps:**
1. Send `GET / HTTP/1.1\r\nHost: foo.com \r\nHello: World\r\n\r\n` to http_parser
2. Observe on_header_value callback receives `foo.com ` (trailing space) instead of `foo.com`
3. In Envoy, configure a block rule for `my-super-private-domain.com`
4. Send `GET / HTTP/1.1\r\nHost: my-super-private-domain.com \r\nHello: World\r\n\r\n`; matcher fails due to trailing whitespace and request is tunneled to the blocked domain
**How found:** Working on an Envoy security issue, the reporter traced the untrimmed value back to http_parser and wrote a regression test showing the trailing LWS is passed up.
**Exploitation:** Attacker appends a trailing space to the Host header; a proxy/filter that matches on exact header value fails to match its blocklist entry, forwarding the request to a domain that should be blocked.
**Escalation:** Any http_parser-based server enforcing header-value-based access controls (domain blocklists, allowlists) can be bypassed with whitespace, enabling privileged escalation / SSRF-style tunneling.
**Insight:** When a proxy enforces policy on parsed header values, check whether the parser preserves optional whitespace (OWS/LWS) — spec-permitted trailing spaces create a parser-differential between the filter's matcher and the downstream server's interpretation.