The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docs | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade openjdk17Upgrade nodejs | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade v8-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs-devel | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-full-i18n | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade graalvm-community-17-regexUpgrade nodejs-packagingUpgrade graalvm-community-17-llvm-toolchainUpgrade graalvm-community-17-polyglotUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-nodejsUpgrade graalvm-community-17-toolsUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-libpolyglotUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-wasmUpgrade graalvm-community-17-python-develUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-espressoUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-native-image-llvm-backendUpgrade nodejs-libsUpgrade graalvm-community-17-rubyUpgrade npmUpgrade nodejsUpgrade graalvm-community-17-jdkUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-llvmUpgrade nodejs-devel | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsNo solution exists | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade nodejs18-docsUpgrade nodejs12Upgrade nodejs12-develUpgrade nodejs12-docsUpgrade corepack16Upgrade corepack18Upgrade npm14Upgrade nodejs16Upgrade nodejs18Upgrade nodejs14-develUpgrade nodejs16-docsUpgrade npm16Upgrade nodejs16-develUpgrade corepack14Upgrade nodejs14-docsUpgrade npm12Upgrade nodejs18-develUpgrade npm18Upgrade nodejs14 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade libnode64Upgrade nodejsUpgrade nodejs-docUpgrade libnode72Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libnode-devUpgrade libnode108Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro) | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub