
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
@achingbrain/http-parser-js
Advanced tools
This is a fork of
http-parser-jswithout the dependency onnode:bufferand converted to ESM
This library parses HTTP protocol for requests and responses.
It was created to replace http_parser.c since calling C++ functions from JS is really slow in V8.
However, it is now primarily useful in having a more flexible/tolerant HTTP parser when dealing with legacy services that do not meet the strict HTTP parsing rules Node's parser follows.
This is packaged as a standalone npm module. To use in node, monkeypatch HTTPParser.
// Monkey patch before you require http for the first time.
process.binding('http_parser').HTTPParser = require('http-parser-js').HTTPParser;
var http = require('http');
// ...
Simply run npm test.
The tests are copied from node and mscedex/io.js, with some modifcations.
This should now be usable in any node application, it now supports (nearly) everything http_parser.c does while still being tolerant with corrupted headers, and other kinds of malformed data.
http-parser-js should work via monkey-patching on Node v6-v11, and v13-14.
Node v12.x renamed the internal http parser, and did not expose it for monkey-patching, so to be able to monkey-patch on Node v12, you must run node --http-parser=legacy file.js to opt in to the old, monkey-patchable http_parser binding.
While this module is intended to be used as a replacement for the internal Node.js parser, it can be used as a standalone parser. The standalone-example.js demonstrates how to use the somewhat awkward API (coming from compatibility with the Node.js internals) to parse HTTP from raw Buffers.
MIT. See LICENSE.md
FAQs
A pure JS HTTP parser
We found that @achingbrain/http-parser-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.