CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR
Last updated 24 July 2024
Other sources
Node.js is vulnerable to HTTP request smuggling, caused by the failure to strictly use the CRLF sequence to delimit HTTP requests by the llhttp parser in the http module. By sending specially crafted HTTP request headers, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
— GitHub
The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/llhttpto a version that resolves this vulnerability.Fixed in 8.1.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.20.1Fixed in 18.16.1Fixed in 20.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.20.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.16.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.3.1 - Upgrade
Upgrade
alpine/openjdk17to a version that resolves this vulnerability.Fixed in 17.0.9_p8-r0 - Upgrade
Upgrade
debian/llhttpto a version that resolves this vulnerability.Fixed in 9.4.3+~cs12.11.9-2 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.21.0+dfsg+~cs24.13.4-1Fixed in 24.22.2+dfsg+~cs24.19.2-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-30589?
CVE-2023-30589 is a vulnerability in the llhttp parser in the http module in Node v20.2.0 that can lead to HTTP Request Smuggling (HRS).
How does CVE-2023-30589 affect Node.js?
CVE-2023-30589 affects Node.js versions 16.0.0, 18.0.0, 20.0.0, and 20.2.0.
What is the severity of CVE-2023-30589?
CVE-2023-30589 has a severity rating of high.
How can I fix CVE-2023-30589?
To fix CVE-2023-30589, update the llhttp package to version 8.1.1 or higher.
Where can I find more information about CVE-2023-30589?
You can find more information about CVE-2023-30589 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-30589), [HackerOne](https://hackerone.com/reports/2001873), [GitHub](https://github.com/nodejs/llhttp/releases/tag/release%2Fv8.1.1).