CVE-2023-30589

Name of the Vulnerable Software and Affected Versions Node.js versions v16 through v20

Description The issue is related to the llhttp parser in the http module, which does not strictly use the CRLF sequence to delimit HTTP requests, leading to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser, contrary to RFC7230 section 3, which states that only the CRLF sequence should delimit each header-field.

Recommendations For Node.js versions v16 through v20, at the moment, there is no information about a newer version that contains a fix for this vulnerability.