HTTP Request Smuggling Vulnerability in Node.js by OpenJS Foundation

CVE-2023-30589

What is CVE-2023-30589?

The llhttp parser present in the HTTP module of Node.js versions 16, 18, and 20 fails to properly enforce the CRLF sequence for HTTP request delimitation. This oversight allows the parser to interpret the CR character alone as a valid delimiter, which deviates from the specifications set by RFC7230. This vulnerability can inadvertently lead to HTTP Request Smuggling (HRS), enabling attackers to manipulate request headers and execute malicious actions.

References