---
id: 5725
title: "CRLF-Powered Desync Attacks: Beheading HTTP Streams"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/crlf-powered-desync-attacks"
published_at: "2026-08-05T23:30:00Z"
tags: ["vulnerability-research", "attack-chains", "web-security", "xss", "http-desync", "request-smuggling", "portswigger", "httponly", "crlf-injection"]
phying_url: "https://phying.com/item/5725"
lang: en
---

# CRLF-Powered Desync Attacks: Beheading HTTP Streams

## Summary

PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2026-08-05T23:30:00Z
- **Original:** https://portswigger.net/research/crlf-powered-desync-attacks
- **Phying News:** https://phying.com/item/5725