CVE-2025-23167: Improper HTTP header block termination in llhttp
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.
The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.
Other sources
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.
The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.
Impact: This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.19.2 - Upgrade
Upgrade
llhttpto a version that resolves this vulnerability.Fixed in 9
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2025-23167?
CVE-2025-23167 is considered a critical severity vulnerability due to its potential to enable request smuggling and bypass access controls.
How do I fix CVE-2025-23167?
To fix CVE-2025-23167, upgrade Node.js to version 20.x or later, where this vulnerability has been resolved.
Which versions of Node.js are affected by CVE-2025-23167?
CVE-2025-23167 affects all Node.js versions prior to and including 20.x.
What kind of attacks can be executed due to CVE-2025-23167?
CVE-2025-23167 allows attackers to perform request smuggling attacks, which can lead to unauthorized request submissions.
How does CVE-2025-23167 affect web applications?
CVE-2025-23167 can compromise web applications by allowing attackers to bypass proxy-based access controls, posing a security risk.