news
PortSwigger Research
November 4th, 2026 at 3:12 PMMaking HTTP header injection critical with one prompt
You can now escalate HTTP header injection to a CRLF-Powered Desync and exploit it to serve random users a redirect to your collaborator, in a single prompt. We’ve just introduced a new scan check for
Get stories like this every Monday
The week's most important AI news in one email. Free, unsubscribe anytime.
Score: 3.03
Engagement proxy: 0
Canonical link: https://portswigger.net/research/making-http-header-injection-critical-with-one-prompt