VYPR
High severityNVD Advisory· Published Jun 30, 2023· Updated Nov 4, 2025

CVE-2023-30589

CVE-2023-30589

Description

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
llhttpnpm
< 8.1.18.1.1

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

21

News mentions

0

No linked articles in our index yet.