The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade npmUpgrade nodejs-packaging | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade openjdk17Upgrade nodejs | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade v8-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-docs | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-jdkUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-native-image-llvm-backendUpgrade graalvm-community-17-wasmUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-rubyUpgrade nodejsUpgrade npmUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-17-python-develUpgrade nodejs-libsUpgrade graalvm-community-17-llvmUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-ruby-develUpgrade nodejs-develUpgrade graalvm-community-17-llvm-toolchainUpgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-regexUpgrade graalvm-community-17-libpolyglotUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-toolsUpgrade graalvm-community-17-polyglotUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-nodejsUpgrade nodejs-packagingUpgrade nodejs-full-i18n | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoNo solution existsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-full-i18n | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsource | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade nodejs14-docsUpgrade nodejs18-develUpgrade nodejs14Upgrade corepack14Upgrade npm12Upgrade npm18Upgrade corepack18Upgrade nodejs14-develUpgrade nodejs12-develUpgrade nodejs16-docsUpgrade npm16Upgrade nodejs16-develUpgrade nodejs18-docsUpgrade npm14Upgrade nodejs18Upgrade corepack16Upgrade nodejs12-docsUpgrade nodejs12Upgrade nodejs16 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade libnode64Upgrade nodejs-docUpgrade libnode72Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejsUpgrade libnode108Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro) | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub