CVE-2023-30589
Severity
7.5HIGH
EPSS
1.9%
top 16.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 1
Latest updateApr 16
Description
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6
Affected Packages4 packages
Also affects: Fedora 37, 38
Patches
🔴Vulnerability Details
6GHSA▶
aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser↗2023-07-20
📋Vendor Advisories
5Microsoft▶
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
The CR character (without LF) i↗2023-06-13
Debian▶
CVE-2023-30589: llhttp - The llhttp parser in the http module in Node v20.2.0 does not strictly use the C...↗2023