CVE-2023-30589 — NodeJS / Node

Description (CNA)

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Affected (CNA)

Vendor / product	Versions
NodeJS / Node	affected 4.0 before 4.; affected 5.0 before 5.; affected 6.0 before 6.; affected 7.0 before 7.; affected 8.0 before 8.; affected 9.0 before 9.; affected 10.0 before 10.; affected 11.0 before 11.; affected 12.0 before 12.; affected 13.0 before 13.; affected 14.0 before 14.; affected 15.0 before 15.; affected 16.0 before 16.20.1; affected 17.0 before 17.; affected 18.0 before 18.16.1; affected 19.0 before 19.; affected 20.0 before 20.3.1

Vendor / product

Versions

NodeJS / Node

affected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.*; affected 13.0 before 13.*; affected 14.0 before 14.*; affected 15.0 before 15.*; affected 16.0 before 16.20.1; affected 17.0 before 17.*; affected 18.0 before 18.16.1; affected 19.0 before 19.*; affected 20.0 before 20.3.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.