CVE-2023-30589

HIGH7.5EPSS 1.9%

llhttp vulnerable to HTTP request smuggling

Published: 7/1/2023Modified: 2/4/2026

Also known as:GHSA-cggh-pq45-6h9xBIT-node-2023-30589BIT-node-min-2023-30589CGA-qmjj-5xgh-8m5x

Description

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Affected packages (5)

Bitnami/node>= 16.0.0, < 16.20.1, >= 18.0.0, < 18.16.1, >= 20.0.0, < 20.3.1
Bitnami/node-min>= 16.0.0, < 16.20.1, >= 18.0.0, < 18.16.1, >= 20.0.0, < 20.3.1
Debian/nodejsfrom 0, < 12.22.12~dfsg-1~deb11u5
Debian/nodejsfrom 0, < 12.22.12~dfsg-1~deb11u5
npm/llhttpfrom 0, < 8.1.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

Affected packages (5)

CVSS scores

References (22)