CVE-2023-30589

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

3.91%

Published

Jun 30, 2023

Modified

Nov 4, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products (5)

nodejs · node.js (up to 16.20.1)vulnerable

nodejs · node.js (up to 18.16.1)vulnerable

nodejs · node.js (up to 20.3.1)vulnerable

fedoraproject · fedoravulnerable

References (19)

https://hackerone.com/reports/2001873

ExploitIssue TrackingThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/

Mailing List