The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Fedoraproject |
|
| Nodejs |
|
| Redhat |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | |||
| nodejs:18-8080020230718130356.63b34585 | cpe:/a:redhat:enterprise_linux:8 | RHSA-2023:4536 | 2023-08-08T00:00:00Z |
| nodejs:16-8080020230718141521.63b34585 | cpe:/a:redhat:enterprise_linux:8 | RHSA-2023:4537 | 2023-08-08T00:00:00Z |
| Red Hat Enterprise Linux 8.6 Extended Update Support | |||
| nodejs:16-8060020230906023909.ad008a3a | cpe:/a:redhat:rhel_eus:8.6 | RHSA-2023:5361 | 2023-09-26T00:00:00Z |
| Red Hat Enterprise Linux 9 | |||
| nodejs:18-9020020230717125503.rhel9 | cpe:/a:redhat:enterprise_linux:9 | RHSA-2023:4330 | 2023-07-31T00:00:00Z |
| nodejs-1:16.20.1-1.el9_2 | cpe:/a:redhat:enterprise_linux:9 | RHSA-2023:4331 | 2023-07-31T00:00:00Z |
| Red Hat Enterprise Linux 9.0 Extended Update Support | |||
| nodejs-1:16.20.2-1.el9_0 | cpe:/a:redhat:rhel_eus:9.0 | RHSA-2023:5533 | 2023-10-09T00:00:00Z |
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-3886-1 | nodejs security update |
 Debian DSA |
DSA-5589-1 | nodejs security update |
 EUVD |
EUVD-2023-2033 | The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 |
 Github GHSA |
GHSA-cggh-pq45-6h9x | llhttp vulnerable to HTTP request smuggling |
 Ubuntu USN |
USN-6735-1 | Node.js vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 04 Nov 2025 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 16 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Thu, 13 Feb 2025 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 | The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 |
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2025-11-04T16:10:09.729Z
Reserved: 2023-04-13T01:00:12.086Z
Link: CVE-2023-30589
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-07-01T00:15:10.293
Modified: 2025-11-04T17:15:36.953
Link: CVE-2023-30589
Redhat
OpenCVE Enrichment
No data.