The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemon | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade nodejsUpgrade openjdk17 | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade v8-develUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade graalvm-community-21-jdkUpgrade graalvm-community-21-native-imageUpgrade npmUpgrade nodejs-libsUpgrade nodejsUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-wasmUpgrade graalvm-community-17-jdkUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-native-image-llvm-backendUpgrade graalvm-community-17-llvmUpgrade nodejs-develUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-python-develUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-17-nodejs-develUpgrade nodejs-full-i18nUpgrade graalvm-community-17-llvm-toolchainUpgrade nodejs-nodemonUpgrade graalvm-community-17-polyglotUpgrade nodejs-docsUpgrade graalvm-community-17-toolsUpgrade graalvm-community-17-nodejsUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-regexUpgrade nodejs-packaging-bundlerUpgrade nodejs-packaging | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsNo solution existsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade npm | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-devel | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade npm18Upgrade npm12Upgrade corepack14Upgrade nodejs14Upgrade nodejs14-docsUpgrade nodejs18-develUpgrade nodejs18Upgrade nodejs16Upgrade npm14Upgrade nodejs16-develUpgrade nodejs12-docsUpgrade corepack18Upgrade nodejs14-develUpgrade nodejs16-docsUpgrade nodejs12-develUpgrade nodejs12Upgrade nodejs18-docsUpgrade corepack16Upgrade npm16 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade libnode108Upgrade libnode-devUpgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade libnode64Upgrade libnode72Upgrade nodejsUpgrade nodejs-docUpgrade nodejs (Ubuntu Pro) | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub