CVE-2026-66731 affects facil.io versions 0.7.5 through 0.7.6. The vulnerability exists in the HTTP/1.1 chunked transfer encoding parser, specifically in http1_parser.h. When processing a chunked POST request, if the chunk size field contains a leading minus sign (negative value), the parser incorrectly converts this into a large positive integer. This corrupts internal parser state and causes the read pointer to move into unmapped memory, resulting in a server crash (denial-of-service). The flaw can be triggered remotely by unauthenticated attackers sending a single malicious request.

Successful exploitation results in a denial-of-service condition by crashing the facil.io server. This can disrupt availability of services relying on facil.io. There is no indication of code execution or data leakage from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided data. Until a patch is available, consider filtering or blocking suspicious chunked transfer encoding requests with negative chunk sizes at network or application layers.