The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade openjdk17Upgrade nodejs | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade v8-develUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-libs-debuginfo | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade npmUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debuginfo | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-toolsUpgrade graalvm-community-17-llvm-toolchainUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-nodejsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade graalvm-community-17-regexUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-polyglotUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade graalvm-community-17-native-image-llvm-backendUpgrade nodejs-develUpgrade npmUpgrade nodejsUpgrade graalvm-community-17-jdkUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-wasmUpgrade graalvm-community-17-llvmUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-python-develUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-espressoUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-nodejs-devel | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerNo solution existsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libs | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-devel | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade nodejs18-docsUpgrade corepack16Upgrade nodejs14-develUpgrade nodejs16-develUpgrade npm14Upgrade nodejs12-docsUpgrade nodejs16Upgrade corepack18Upgrade npm16Upgrade nodejs18Upgrade nodejs12-develUpgrade nodejs12Upgrade nodejs16-docsUpgrade corepack14Upgrade npm12Upgrade nodejs14-docsUpgrade nodejs18-develUpgrade npm18Upgrade nodejs14 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade nodejs-docUpgrade libnode64Upgrade nodejsUpgrade nodejs (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade libnode72Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode108Upgrade libnode-dev | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub