Executive brief
llhttp is an HTTP parser library used by Node.js to process incoming web requests. Due to improper validation of header field delimiters, attackers can bypass security controls and smuggle malicious requests through proxies and firewalls, potentially leading to cache poisoning, session hijacking, or access to unauthorized backend services.
Technical details
The vulnerability is a CWE-444 (HTTP Request Smuggling) issue in llhttp's header parsing logic. The parser incorrectly accepts a lone line feed (LF) character as sufficient to delimit HTTP header fields, whereas RFC 7230 requires a carriage return + line feed (CRLF) sequence. This relaxed parsing allows an attacker to craft malformed HTTP requests that are interpreted differently by llhttp versus downstream HTTP infrastructure, enabling request smuggling attacks. The vulnerability affects all versions prior to 6.0.7 and is exploitable via network access without authentication or user interaction.
Affected products
- Node.js llhttp before 6.0.7
Timeline
- 2022-07-15: disclosed: Advisory published
- 2022-07-06: patched: Fix released in llhttp 6.0.7