From 08e5c13da4b2404e824a8e358f1093393ee41780 Mon Sep 17 00:00:00 2001
From: Willi Ballenthin <willi.ballenthin@gmail.com>
Date: Sat, 20 Jun 2026 11:49:47 +0200
Subject: [PATCH] fix Dechunk HTTP Response leaks terminating chunk and
 trailers into output (#2290)

---
 src/core/operations/DechunkHTTPResponse.mjs   |  5 +-
 .../operations/tests/DechunkHTTPResponse.mjs  | 66 +++++++++++++++++++
 2 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 tests/operations/tests/DechunkHTTPResponse.mjs

diff --git a/src/core/operations/DechunkHTTPResponse.mjs b/src/core/operations/DechunkHTTPResponse.mjs
index da2eb437..40b97c7a 100644
--- a/src/core/operations/DechunkHTTPResponse.mjs
+++ b/src/core/operations/DechunkHTTPResponse.mjs
@@ -45,12 +45,15 @@ class DechunkHTTPResponse extends Operation {
         const lineEndingsLength = lineEndings.length;
         let chunkSize = parseInt(input.slice(0, chunkSizeEnd), 16);
         while (!isNaN(chunkSize)) {
+            if (chunkSize === 0) {
+                break;
+            }
             chunks.push(input.slice(chunkSizeEnd, chunkSize + chunkSizeEnd));
             input = input.slice(chunkSizeEnd + chunkSize + lineEndingsLength);
             chunkSizeEnd = input.indexOf(lineEndings) + lineEndingsLength;
             chunkSize = parseInt(input.slice(0, chunkSizeEnd), 16);
         }
-        return chunks.join("") + input;
+        return chunks.join("");
     }
 
 }
diff --git a/tests/operations/tests/DechunkHTTPResponse.mjs b/tests/operations/tests/DechunkHTTPResponse.mjs
new file mode 100644
index 00000000..2a678c89
--- /dev/null
+++ b/tests/operations/tests/DechunkHTTPResponse.mjs
@@ -0,0 +1,66 @@
+/**
+ * DechunkHTTPResponse operation tests.
+ *
+ * @author Willi Ballenthin
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        name: "Dechunk HTTP response: CRLF line endings",
+        input: "7\r\nMozilla\r\n9\r\nDeveloper\r\n7\r\nNetwork\r\n0\r\n\r\n",
+        expectedOutput: "MozillaDeveloperNetwork",
+        recipeConfig: [
+            {
+                op: "Dechunk HTTP response",
+                args: [],
+            },
+        ],
+    },
+    {
+        name: "Dechunk HTTP response: LF line endings",
+        input: "7\nMozilla\n9\nDeveloper\n7\nNetwork\n0\n\n",
+        expectedOutput: "MozillaDeveloperNetwork",
+        recipeConfig: [
+            {
+                op: "Dechunk HTTP response",
+                args: [],
+            },
+        ],
+    },
+    {
+        name: "Dechunk HTTP response: single chunk",
+        input: "5\r\nHello\r\n0\r\n\r\n",
+        expectedOutput: "Hello",
+        recipeConfig: [
+            {
+                op: "Dechunk HTTP response",
+                args: [],
+            },
+        ],
+    },
+    {
+        name: "Dechunk HTTP response: trailing headers discarded",
+        input: "7\nMozilla\n9\nDeveloper\n7\nNetwork\n0\nExpires: Wed, 21 Oct 2015 07:28:00 GMT\n",
+        expectedOutput: "MozillaDeveloperNetwork",
+        recipeConfig: [
+            {
+                op: "Dechunk HTTP response",
+                args: [],
+            },
+        ],
+    },
+    {
+        name: "Dechunk HTTP response: hex chunk sizes",
+        input: "a\r\n0123456789\r\n0\r\n\r\n",
+        expectedOutput: "0123456789",
+        recipeConfig: [
+            {
+                op: "Dechunk HTTP response",
+                args: [],
+            },
+        ],
+    },
+]);