That's not quite true. The http-parser library has some bits lifted from nginx. Node itself, however, does not, and the bug is not quite the same as the nginx bug (though they do have a lot of words in common: attacker, request, carefully-crafted, etc. ;P
The impact of the bug is the same, and it's an idiosyncratic kind of memory corruption bug, which is why I thought the original flaw might have been inherited. Thanks for clearing it up.
s/corruption/information leak
To my mind the exact same class of bugs, but you're not wrong to clarify. It's a particularly bad breed of "disclosure".
Ah I see. Thanks I missed it there in the /deps directory, I just followed the link to a node C++ file in the commit in question.