tiny‑http through version 0.12.0 improperly parses the Transfer‑Encoding header by unconditionally applying chunk decoding and discarding the Content‑Length value. A remote attacker can send a Transfer‑Encoding header with any value, including non‑chunked codings, causing the library to interpret the incoming byte stream differently from a correctly‑implemented front‑end proxy. This desynchronization allows the attacker to smuggle additional HTTP requests to the backend application and, if non‑chunked bodies are paired with non‑chunked Transfer‑Encoding values, can cause failed body reads that tie up connections and consume worker threads without returning an error to the client.

All installations of tiny‑http through version 0.12.0 are affected. No later versions are listed as vulnerable. The vulnerability resides in the HTTP request handling component of the library.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation at the time of analysis. The vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector is a remote network attacker who can reach the tiny‑http instance behind a correctly‑configured front‑end proxy and craft a malicious Transfer‑Encoding header. If the proxy forwards the header to tiny‑http, the attacker can split the request into two distinct stream interpretations, achieving request smuggling. Additionally, by sending malformed bodies with non‑chunked Transfer‑Encoding values, the attacker can trigger resource exhaustion that may degrade service availability.