CVE-2023-30589: llhttp HTTP request smuggling via improper CRLF delimiters

CVE-2023-30589 · Severity: low · CVSS 3.1 · Published 2023-07-01

The llhttp HTTP parser, used in Node.js, does not strictly enforce the CRLF (carriage return + line feed) delimiter required by HTTP specifications. An attacker can exploit this by using a single CR character to delimit headers, leading to HTTP request smuggling attacks where malicious requests are misinterpreted by proxies or servers, potentially bypassing security controls and enabling cache poisoning or request hijacking.

Technologies: Nodejs Node.Js, llhttp (npm). Vendors: Nodejs, npm.

Quick answers

Is CVE-2023-30589 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-30589 being exploited in the wild.
How severe is CVE-2023-30589?
Low severity, with a CVSS score of 3.1, published 1 July 2023.
Which products and versions are affected?
Nodejs Node.Js v16, v18, v20; llhttp (npm) SEMVER:introduced=0,fixed=8.1.1.
Is there a fix for CVE-2023-30589?
Yes. llhttp (npm): upgrade to 8.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-30589 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-30589?
Check whether you run Nodejs Node.Js or llhttp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • llhttp (npm): upgrade to 8.1.1 or later
    npm install llhttp@8.1.1

Technical details

The vulnerability is a protocol compliance flaw in the llhttp parser's HTTP header field delimiter validation. The parser accepts a single CR character as a valid header delimiter instead of strictly requiring CRLF as specified in RFC 7230 Section 3. This allows an attacker to craft malformed HTTP requests that may be interpreted differently by proxies, caches, or backend servers, enabling HTTP request smuggling attacks. No authentication or user interaction is required; the attack is triggered by sending a specially crafted HTTP request over the network. An attacker can exploit this to inject unauthorized requests, bypass security filters, or poison web caches. The vulnerability was fixed in llhttp v8.1.1.

Affected products

  • nodejs llhttp before 8.1.1
  • nodejs Node.js v16, v18, v20

Identifiers

  • CVE-2023-30589
  • GHSA-cggh-pq45-6h9x

Timeline

  • 2023-07-01: disclosed: Vulnerability published
  • 2023-07-01: patched: llhttp v8.1.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.