NetSight
IP …
high7.5

CVE-2023-30589

llhttp vulnerable to HTTP request smuggling

Impact

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Affected packages

EcosystemPackageAffectedFixed in
npmllhttp< 8.1.18.1.1

Affected products

VendorProductAffected versions
NodejsNode.Js
from 16.0.0 before 16.20.1
from 18.0.0 before 18.16.1
from 20.0.0 before 20.3.1
FedoraprojectFedora
Versions 37, 38

References