CVE-2025-23167
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
19/05/2025
Last modified:
19/05/2025
Description
A flaw in Node.js 20&#39;s HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`.<br />
This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.<br />
<br />
The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.<br />
<br />
Impact:<br />
* This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM