CVE-2023-30589

2023-07-0100:15:10

Debian Security Bug Tracker

security-tracker.debian.org

node.js

llhttp parser

http request smuggling

rfc7230

http header fields

crlf sequence

v20.2.0

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.0%

JSON

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

OSVersionArchitecturePackageVersionFilename
Debian12allnodejs< 18.19.0+dfsg-6~deb12u1nodejs_18.19.0+dfsg-6~deb12u1_all.deb
Debian11allnodejs<= 12.22.12~dfsg-1~deb11u4nodejs_12.22.12~dfsg-1~deb11u4_all.deb
Debian10allnodejs< 10.24.0~dfsg-1~deb10u1nodejs_10.24.0~dfsg-1~deb10u1_all.deb
Debian999allnodejs< 18.13.0+dfsg1-1.1nodejs_18.13.0+dfsg1-1.1_all.deb
Debian13allnodejs< 18.13.0+dfsg1-1.1nodejs_18.13.0+dfsg1-1.1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	nodejs	< 18.19.0+dfsg-6~deb12u1	nodejs_18.19.0+dfsg-6~deb12u1_all.deb
Debian	11	all	nodejs	<= 12.22.12~dfsg-1~deb11u4	nodejs_12.22.12~dfsg-1~deb11u4_all.deb
Debian	10	all	nodejs	< 10.24.0~dfsg-1~deb10u1	nodejs_10.24.0~dfsg-1~deb10u1_all.deb
Debian	999	all	nodejs	< 18.13.0+dfsg1-1.1	nodejs_18.13.0+dfsg1-1.1_all.deb
Debian	13	all	nodejs	< 18.13.0+dfsg1-1.1	nodejs_18.13.0+dfsg1-1.1_all.deb