The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packaging-bundler | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade nodejsUpgrade openjdk17 | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade v8-develUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-libs-debuginfo | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade graalvm-community-17-polyglotUpgrade nodejs-nodemonUpgrade graalvm-community-17-toolsUpgrade graalvm-community-17-icu4jUpgrade nodejs-full-i18nUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-llvm-toolchainUpgrade graalvm-community-17-regexUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-nodejsUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-native-image-llvm-backendUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-rubyUpgrade nodejs-libsUpgrade graalvm-community-17-wasmUpgrade graalvm-community-17-jdkUpgrade nodejsUpgrade npmUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-python-develUpgrade graalvm-community-17-espresso-llvmUpgrade nodejs-develUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-llvmUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-python | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nNo solution existsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade npm | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-devel | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade nodejs12-develUpgrade nodejs16-develUpgrade nodejs16-docsUpgrade npm14Upgrade npm16Upgrade corepack16Upgrade nodejs18Upgrade nodejs18-docsUpgrade corepack18Upgrade nodejs12Upgrade nodejs14-develUpgrade nodejs16Upgrade nodejs12-docsUpgrade nodejs18-develUpgrade npm12Upgrade npm18Upgrade nodejs14Upgrade corepack14Upgrade nodejs14-docs | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade libnode64Upgrade nodejs-docUpgrade nodejsUpgrade nodejs-legacy (Ubuntu Pro)Upgrade libnode72Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade libnode-devUpgrade libnode108 | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub