The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade npm | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade nodejsUpgrade openjdk17 | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade v8-develUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-devel | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-docsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-full-i18n | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade nodejsUpgrade npmUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-17-python-develUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-jdkUpgrade graalvm-community-17-native-image-llvm-backendUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-rubyUpgrade nodejs-libsUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-wasmUpgrade nodejs-develUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-llvmUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-regexUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-llvm-toolchainUpgrade nodejs-full-i18nUpgrade graalvm-community-17-polyglotUpgrade graalvm-community-17-icu4jUpgrade nodejs-docsUpgrade graalvm-community-17-toolsUpgrade graalvm-community-17-nodejsUpgrade graalvm-community-17-javascriptUpgrade nodejs-nodemon | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-libsNo solution existsUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfo | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-devel | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade nodejs12-docsUpgrade nodejs18-docsUpgrade corepack18Upgrade corepack16Upgrade nodejs16-develUpgrade npm14Upgrade npm16Upgrade nodejs14-develUpgrade nodejs12-develUpgrade nodejs16Upgrade nodejs16-docsUpgrade nodejs12Upgrade nodejs18Upgrade nodejs18-develUpgrade nodejs14-docsUpgrade nodejs14Upgrade corepack14Upgrade npm18Upgrade npm12 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode-devUpgrade libnode108Upgrade nodejs-docUpgrade libnode72Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejsUpgrade libnode64 | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub