7.5

CVE-2023-30589

Exploit

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Data is provided by the National Vulnerability Database (NVD)
Nodejs ≫ Node.Js SwEdition- Version >= 16.0.0 < 16.20.1
Nodejs ≫ Node.Js SwEdition- Version >= 18.0.0 < 18.16.1
Nodejs ≫ Node.Js SwEdition- Version >= 20.0.0 < 20.3.1
Fedoraproject ≫ Fedora Version37
Fedoraproject ≫ Fedora Version38
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.92% 0.827
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
https://hackerone.com/reports/2001873
Third Party Advisory
Exploit
Issue Tracking