The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-devel | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade nodejsUpgrade openjdk17 | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade v8-develUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npm | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-native-image-llvm-backendUpgrade graalvm-community-17-python-develUpgrade graalvm-community-17-wasmUpgrade graalvm-community-17-ruby-develUpgrade nodejs-develUpgrade graalvm-community-17-llvmUpgrade graalvm-community-17-nodejs-develUpgrade npmUpgrade nodejsUpgrade graalvm-community-17-jdkUpgrade graalvm-community-17-rubyUpgrade nodejs-libsUpgrade graalvm-community-17-llvm-toolchainUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-regexUpgrade graalvm-community-17-polyglotUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade graalvm-community-17-nodejsUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-icu4jUpgrade nodejs-docsUpgrade graalvm-community-17-tools | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejsNo solution existsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libs | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade npmUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-devel | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade nodejs18-develUpgrade nodejs14Upgrade npm18Upgrade npm12Upgrade corepack14Upgrade nodejs14-docsUpgrade corepack18Upgrade nodejs18Upgrade nodejs16Upgrade nodejs14-develUpgrade nodejs12Upgrade npm16Upgrade npm14Upgrade nodejs12-docsUpgrade nodejs16-develUpgrade nodejs18-docsUpgrade corepack16Upgrade nodejs16-docsUpgrade nodejs12-devel | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode108Upgrade nodejs-doc (Ubuntu Pro)Upgrade libnode-devUpgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs-docUpgrade nodejs (Ubuntu Pro)Upgrade libnode64Upgrade libnode72Upgrade nodejs | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub