fix: drop split CRLFCRLF terminator bytes from the header buffer

deps/dicer/lib/HeaderParser.js

@@ -29,6 +29,7 @@ HeaderParser.prototype.push = function (data) {
   let end = data.length
   let appendEnd = data.length
   let found = false
+  let splitTail = 0
   const tail = this.tail
 
   for (let i = tail.length; i > 0; --i) {
@@ -40,6 +41,7 @@ HeaderParser.prototype.push = function (data) {
       if (matched) {
         end = S_DCRLF.length - i
         appendEnd = 0
+        splitTail = i
         found = true
         break
       }
@@ -74,6 +76,14 @@ HeaderParser.prototype.push = function (data) {
   }
 
   if (found) {
+    // A CRLFCRLF header terminator split across pushes left its leading bytes
+    // in this.buffer on the previous push; drop them so they do not trail the
+    // last header value. splitTail is 0 in the common case, making this a no-op.
+    // Skip when maxed: once maxHeaderSize truncation dropped the trailing bytes,
+    // the last splitTail bytes are real header content, not the terminator prefix.
+    if (!this.maxed) {
+      this.buffer = this.buffer.slice(0, this.buffer.length - splitTail)
+    }
     this._finish()
     return end
   }

test/dicer-headerparser.test.js

@@ -19,6 +19,19 @@ test('dicer-headerparser', async t => {
       expected: { foo: ['bar'] },
       what: 'Header terminator across chunks'
     },
+    {
+      source: ['Foo: bar\r', '\n\r\n'],
+      expected: { foo: ['bar'] },
+      what: 'Header terminator split between CR and LFCRLF leaves no trailing CR on the value'
+    },
+    {
+      source: ['Foo: bar\r', '\n\r\n'],
+      cfg: {
+        maxHeaderSize: 8
+      },
+      expected: { foo: ['bar'] },
+      what: 'Header terminator split after maxHeaderSize truncation keeps the value intact'
+    },
     {
       source: ['Foo: bar\r', '\n\r', '\nextra'],
       cfg: {