There is heap-based buffer overflow

[KaanaryOverFlow]

the function is vulnerable

you can fix it

https://medium.com/@Mr.deadbeef.py/esp-unusable-heap-based-buffer-overlow-ba6e8d99f813

[mcspr]

We would appreciate a concise description of the issue, not the link to your blog :/
What's your suggestion for a fix here?

I think what you meant is that this line uses char to store the result of strlen(username) + strlen(password) + 1, and it must stay under 127 bytes to not overflow the value

Arduino/libraries/ESP8266WebServer/src/ESP8266WebServer-impl.h

Line 105 in 6c8c8cb

char toencodeLen = strlen(username)+strlen(password)+1;

[KaanaryOverFlow]

i prefer this solution, exactly, in this line should be validate string length lower than 127 bytes before defining "toencodeLen" for username and password
if you are want to error exception or you can use snprintf(buffer,toencodeLen+1,...) instead of sprintf.

the case is when remote user access the this function, they can trig to overflow