I have pushed security fix to original repo https://github.com/Spritetm/libesphttpd/pull/44 Guess it will be useful for your fork too.