VYPR
← All advisories
Medium severity6.5NVD Advisory· Published May 19, 2025· Updated Apr 15, 2026

CVE-2025-23167

CVE-2025-23167

Description

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact: * This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

17

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.