UpHeron
All vulnerabilities

Servers and applications

CVE-2023-30589

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16,…

Severity
High 7.5
Published
1 Jul 2023
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
16.20.1, 18.16.1, 20.3.1
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 16.0.0 before 16.20.1
  • From 18.0.0 before 18.16.1
  • From 20.0.0 before 20.3.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-30589
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-30589