High severity7.5NVD Advisory· Published Jul 1, 2023· Updated Jun 17, 2026
CVE-2023-30589
CVE-2023-30589
Description
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
llhttpnpm | < 8.1.1 | 8.1.1 |
Affected products
65cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
- osv-coords61 versionspkg:apk/chainguard/nodejs-16pkg:apk/chainguard/nodejs-16-docpkg:apk/chainguard/nodejs-18pkg:apk/chainguard/nodejs-18-docpkg:apk/chainguard/nodejs-20pkg:apk/chainguard/nodejs-20-docpkg:apk/wolfi/nodejs-16pkg:apk/wolfi/nodejs-16-docpkg:apk/wolfi/nodejs-18pkg:apk/wolfi/nodejs-18-docpkg:apk/wolfi/nodejs-20pkg:apk/wolfi/nodejs-20-docpkg:bitnami/nodepkg:bitnami/node-minpkg:npm/llhttppkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/npmpkg:rpm/opensuse/nodejs12&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nodejs14&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nodejs16&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nodejs18&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nodejs18&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/nodejs20&distro=openSUSE%20Tumbleweedpkg:rpm/suse/nodejs12&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/nodejs12&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/nodejs12&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/nodejs14&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/nodejs14&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/nodejs16&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4pkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/nodejs16&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/nodejs18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4pkg:rpm/suse/nodejs18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP5
< 16.20.1-r0+ 60 more
- (no CPE)range: < 16.20.1-r0
- (no CPE)range: < 16.20.1-r0
- (no CPE)range: < 18.16.1-r0
- (no CPE)range: < 18.16.1-r0
- (no CPE)range: < 20.3.1-r0
- (no CPE)range: < 20.3.1-r0
- (no CPE)range: < 16.20.1-r0
- (no CPE)range: < 16.20.1-r0
- (no CPE)range: < 18.16.1-r0
- (no CPE)range: < 18.16.1-r0
- (no CPE)range: < 20.3.1-r0
- (no CPE)range: < 20.3.1-r0
- (no CPE)range: >= 16.0.0, < 16.20.1
- (no CPE)range: >= 16.0.0, < 16.20.1
- (no CPE)range: < 8.1.1
- (no CPE)range: < 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
- (no CPE)range: < 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
- (no CPE)range: < 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
- (no CPE)range: < 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
- (no CPE)range: < 1:16.20.1-1.el9_2
- (no CPE)range: < 2.0.20-2.module_el9.2.0+29+de583a0b
- (no CPE)range: < 2021.06-4.module_el9.1.0+13+d9a595ea
- (no CPE)range: < 2021.06-4.module_el9.1.0+13+d9a595ea
- (no CPE)range: < 1:9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 14.21.3-150200.15.49.1
- (no CPE)range: < 16.20.1-150400.3.21.1
- (no CPE)range: < 18.16.1-150400.9.9.1
- (no CPE)range: < 18.16.1-150400.9.9.1
- (no CPE)range: < 20.3.1-1.1
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 12.22.12-150200.4.50.1
- (no CPE)range: < 14.21.3-150200.15.49.1
- (no CPE)range: < 14.21.3-150200.15.49.1
- (no CPE)range: < 14.21.3-150200.15.49.1
- (no CPE)range: < 14.21.3-150200.15.49.1
- (no CPE)range: < 14.21.3-6.46.1
- (no CPE)range: < 14.21.3-150200.15.49.1
- (no CPE)range: < 14.21.3-150200.15.49.1
- (no CPE)range: < 14.21.3-150200.15.49.1
- (no CPE)range: < 14.21.3-150200.15.49.1
- (no CPE)range: < 14.21.3-150200.15.49.1
- (no CPE)range: < 16.20.1-150300.7.24.2
- (no CPE)range: < 16.20.1-150300.7.24.2
- (no CPE)range: < 16.20.1-150300.7.24.2
- (no CPE)range: < 16.20.1-8.30.1
- (no CPE)range: < 16.20.1-150400.3.21.1
- (no CPE)range: < 16.20.1-150300.7.24.2
- (no CPE)range: < 16.20.1-150300.7.24.2
- (no CPE)range: < 16.20.1-150300.7.24.2
- (no CPE)range: < 18.16.1-8.9.1
- (no CPE)range: < 18.16.1-150400.9.9.1
- (no CPE)range: < 18.16.1-150400.9.9.1
Patches
Vulnerability mechanics
References
21- lists.fedoraproject.org/archives/list/[email protected]/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF/nvdPatchThird Party Advisory
- lists.fedoraproject.org/archives/list/[email protected]/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE/nvdPatchThird Party Advisory
- hackerone.com/reports/2001873nvdExploitIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-cggh-pq45-6h9xghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-30589ghsaADVISORY
- security.netapp.com/advisory/ntap-20230803-0009/nvdThird Party Advisory
- github.com/nodejs/llhttp/releases/tag/release%2Fv8.1.1ghsaWEB
- lists.debian.org/debian-lts-announce/2024/09/msg00029.htmlnvdWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HEghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/nvdMailing List
- lists.fedoraproject.org/archives/list/[email protected]/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYFghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNYghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/nvdMailing List
- lists.fedoraproject.org/archives/list/[email protected]/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYEghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5ghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/nvdMailing List
- lists.fedoraproject.org/archives/list/[email protected]/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76ghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/nvdMailing List
- security.netapp.com/advisory/ntap-20230803-0009ghsaWEB
- security.netapp.com/advisory/ntap-20240621-0006ghsaWEB
- security.netapp.com/advisory/ntap-20240621-0006/nvd
News mentions
0No linked articles in our index yet.