7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
40.2%
The llhttp parser in the http module in Node v20.2.0 does not strictly use
the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request
Smuggling (HRS). The CR character (without LF) is sufficient to delimit
HTTP header fields in the llhttp parser. According to RFC7230 section 3,
only the CRLF sequence should delimit each header-field. This impacts all
Node.js active versions: v16, v18, and, v20
launchpad.net/bugs/cve/CVE-2023-30589
nodejs.org/en/blog/vulnerability/june-2023-security-releases#http-request-smuggling-via-empty-headers-separated-by-cr-medium-cve-2023-30589
nvd.nist.gov/vuln/detail/CVE-2023-30589
security-tracker.debian.org/tracker/CVE-2023-30589
ubuntu.com/security/notices/USN-6735-1
www.cve.org/CVERecord?id=CVE-2023-30589