GHSA-cggh-pq45-6h9x

llhttp vulnerable to HTTP request smuggling

At a glance

Published: 2023-07-01 00:30 UTC
Updated: 2026-09-10 03:49 UTC
CVE: CVE-2023-30589
Aliases: BIT-node-2023-30589, BIT-node-min-2023-30589
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Affected packages

Package	Versions
npm · llhttp	introduced 0, fixed 8.1.1

References

https://nvd.nist.gov/vuln/detail/CVE-2023-30589 ADVISORY
https://hackerone.com/reports/2001873 WEB
https://github.com/nodejs/llhttp PACKAGE
https://github.com/nodejs/llhttp/releases/tag/release%2Fv8.1.1 WEB
https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5 WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76 WEB
https://security.netapp.com/advisory/ntap-20230803-0009 WEB
https://security.netapp.com/advisory/ntap-20240621-0006 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database