The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-nodemon | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade openjdk17Upgrade nodejs | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-docsUpgrade v8-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade npm | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-libs | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade graalvm-community-17-regexUpgrade nodejs-docsUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-toolsUpgrade graalvm-community-17-nodejsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-llvm-toolchainUpgrade graalvm-community-17-polyglotUpgrade nodejs-nodemonUpgrade graalvm-community-17-libpolyglotUpgrade nodejs-develUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-llvmUpgrade nodejs-libsUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-native-image-llvm-backendUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-python-develUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-21-native-imageUpgrade npmUpgrade nodejsUpgrade graalvm-community-17-jdkUpgrade graalvm-community-17-wasm | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingNo solution existsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-docs | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18n | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade npm16Upgrade nodejs16-develUpgrade npm14Upgrade nodejs18-docsUpgrade nodejs12-docsUpgrade corepack16Upgrade nodejs12Upgrade nodejs16-docsUpgrade nodejs14-develUpgrade nodejs12-develUpgrade nodejs16Upgrade nodejs18Upgrade corepack18Upgrade nodejs14-docsUpgrade nodejs18-develUpgrade npm18Upgrade npm12Upgrade corepack14Upgrade nodejs14 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade nodejs-docUpgrade libnode64Upgrade libnode72Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejsUpgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode108 | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub