The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-libsUpgrade npmUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packaging-bundler | Aug 3, 2023 | Jul 1, 2023 |
| Alpine Linux | — | Upgrade nodejsUpgrade openjdk17 | Aug 22, 2024 | Jun 30, 2023 |
| Amazon_linux_2023 | — | Upgrade npmUpgrade v8-develUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-libs | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-devel | Aug 1, 2023 | Jul 1, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jul 1, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 1, 2023 |
| Oracle_linux | — | Upgrade graalvm-community-17-python-develUpgrade nodejsUpgrade graalvm-community-17-wasmUpgrade graalvm-community-21-native-imageUpgrade nodejs-libsUpgrade npmUpgrade nodejs-develUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-17-jdkUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-native-image-llvm-backendUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-llvmUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-nodejsUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-icu4jUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade graalvm-community-17-llvm-toolchainUpgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-polyglotUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade graalvm-community-17-regexUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-tools | Aug 2, 2023 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-libsUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoNo solution existsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-docs | Aug 1, 2023 | Jul 1, 2023 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-devel | Mar 5, 2024 | Jul 1, 2023 |
| Suse | — | Upgrade nodejs18Upgrade nodejs16Upgrade nodejs12Upgrade corepack18Upgrade corepack16Upgrade nodejs12-develUpgrade nodejs16-develUpgrade nodejs12-docsUpgrade npm16Upgrade nodejs14-develUpgrade npm14Upgrade nodejs16-docsUpgrade nodejs18-docsUpgrade nodejs14Upgrade nodejs18-develUpgrade nodejs14-docsUpgrade npm12Upgrade corepack14Upgrade npm18 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade libnode64Upgrade libnode72Upgrade nodejsUpgrade nodejs-docUpgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libnode108Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade libnode-dev | Apr 17, 2024 | Jul 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 30, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub