CVE-2023-30589

HIGH7.5EPSS 1.9%

llhttp vulnerable to HTTP request smuggling

發布日:2023/7/1修改日:2026/2/4

也稱為:GHSA-cggh-pq45-6h9xBIT-node-2023-30589BIT-node-min-2023-30589CGA-qmjj-5xgh-8m5x

描述

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

受影響套件(5)

Bitnami/node>= 16.0.0, < 16.20.1, >= 18.0.0, < 18.16.1, >= 20.0.0, < 20.3.1
Bitnami/node-min>= 16.0.0, < 16.20.1, >= 18.0.0, < 18.16.1, >= 20.0.0, < 20.3.1
Debian/nodejsfrom 0, < 12.22.12~dfsg-1~deb11u5
Debian/nodejsfrom 0, < 12.22.12~dfsg-1~deb11u5
npm/llhttpfrom 0, < 8.1.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

描述

受影響套件(5)

CVSS 分數

參考連結(22)