That's not quite true. The http-parser library has some bits lifted from nginx. Node itself, however, does not, and the bug is not quite the same as the nginx bug (though they do have a lot of words in common: attacker, request, carefully-crafted, etc. ;P