CRLF Injection Vulnerability in ESPAsyncWebServer by ESP32Async

CVE-2025-53094

What is CVE-2025-53094?

The ESPAsyncWebServer library, which serves HTTP and WebSocket applications on microcontrollers like ESP32 and ESP8266, is susceptible to a CRLF injection flaw due to improper handling of HTTP headers. This vulnerability arises from the incorporation of unsanitized input within the header construction process, allowing attackers to inadvertently introduce CR ( ) or LF ( ) characters. Such injections could lead to arbitrary manipulation of HTTP headers and responses, facilitating various attacks. A resolution for this issue is available via a pull request and is set to be included in the upcoming release.

References