The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade nodejsUpgrade openjdk17 | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade v8-develUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libs | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs-packaging | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade graalvm-community-21-native-imageUpgrade nodejs-libsUpgrade nodejsUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-pythonUpgrade nodejs-develUpgrade npmUpgrade graalvm-community-17-jdkUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-wasmUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-native-image-llvm-backendUpgrade graalvm-community-17-llvmUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-python-develUpgrade graalvm-community-17-espresso-llvmUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade graalvm-community-17-regexUpgrade nodejs-docsUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-nodejsUpgrade graalvm-community-17-toolsUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-polyglotUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-llvm-toolchainUpgrade nodejs-full-i18n | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-packagingNo solution existsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debuginfo | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-devel | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade nodejs16Upgrade nodejs12-docsUpgrade nodejs14-develUpgrade nodejs18Upgrade corepack18Upgrade nodejs16-develUpgrade npm14Upgrade npm16Upgrade corepack16Upgrade nodejs16-docsUpgrade nodejs18-docsUpgrade nodejs12Upgrade nodejs12-develUpgrade npm18Upgrade nodejs18-develUpgrade corepack14Upgrade nodejs14-docsUpgrade npm12Upgrade nodejs14 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade libnode108Upgrade libnode-devUpgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade libnode72Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-docUpgrade nodejs-legacy (Ubuntu Pro)Upgrade libnode64Upgrade nodejs | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub