The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packaging-bundler | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade nodejsUpgrade openjdk17 | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade npmUpgrade v8-develUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-devel | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libs | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade graalvm-community-17-llvm-toolchainUpgrade graalvm-community-17-regexUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-libpolyglotUpgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-nodejsUpgrade graalvm-community-17-toolsUpgrade nodejs-nodemonUpgrade graalvm-community-17-polyglotUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-native-image-llvm-backendUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-rubyUpgrade nodejs-libsUpgrade graalvm-community-17-python-develUpgrade graalvm-community-17-wasmUpgrade npmUpgrade nodejsUpgrade graalvm-community-17-jdkUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-llvmUpgrade nodejs-develUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-21-jdk | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-libs-debuginfoNo solution existsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npm | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debuginfo | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade nodejs12Upgrade nodejs14-develUpgrade corepack18Upgrade nodejs16Upgrade nodejs18Upgrade nodejs16-develUpgrade npm14Upgrade nodejs16-docsUpgrade npm16Upgrade nodejs12-develUpgrade nodejs12-docsUpgrade corepack16Upgrade nodejs18-docsUpgrade nodejs14Upgrade nodejs18-develUpgrade nodejs14-docsUpgrade corepack14Upgrade npm12Upgrade npm18 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade nodejs-docUpgrade nodejsUpgrade libnode72Upgrade libnode64Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode108 | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub