Akamai eliminated a potential HTTP request smuggling vulnerability (CVE-2025-54142) arising from the way some origin servers handle OPTIONS requests that include a request body.
The HTTP OPTIONS request method described in RFC 9110 can be used by a client to determine the permitted options for a given URL on the server. Its primary use is within the context of a Cross-Origin Resource Sharing (CORS) to let a browser "preflight" the request in an idempotent manner before issuing the actual request.
Although unusual in practice, the OPTIONS method may be accompanied by an entity-body, even though — per RFC 9110 — there are no known valid use cases for such requests, and no known browser or mobile client would normally issue requests of this sort.
Details
Certain RFC noncompliant origin stacks do not properly consume the request body when it is forwarded to them by Akamai’s proxy servers, which could then lead to the payload remaining in the persistent connection between a proxy and an origin server.
A subsequent regular HTTP request to the same origin could then be appended and trigger the origin to interpret the smuggled request.
This offered an attacker a window of opportunity for cache poisoning or other security-related threats, depending on the origin server’s configuration.
Mitigation
In addition to the WAF Rapid Rule we deployed on July 21, 2025, to protect against this specific request smuggling vector, we have implemented a separate, platform-wide change that eliminates this and similar attack vectors by terminating the connection to an origin and client for any OPTIONS requests with a body. This change was fully deployed on August 11, 2025.
Tags
