# CVE-2023-30589: llhttp HTTP request smuggling via improper CRLF delimiters

Source: https://junglewise.ai/threats/cve-2023-30589-llhttp-http-request-smuggling-via-improper-crlf-delimiters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-07-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-30589 · Severity: low · CVSS 3.1 · Published 2023-07-01

The llhttp HTTP parser, used in Node.js, does not strictly enforce the CRLF (carriage return + line feed) delimiter required by HTTP specifications. An attacker can exploit this by using a single CR character to delimit headers, leading to HTTP request smuggling attacks where malicious requests are misinterpreted by proxies or servers, potentially bypassing security controls and enabling cache poisoning or request hijacking.

Technologies: [Nodejs Node.Js](https://junglewise.ai/threats/technologies/node-js), [llhttp (npm)](https://junglewise.ai/threats/technologies/llhttp). Vendors: [Nodejs](https://junglewise.ai/threats/vendors/nodejs), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-30589 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-30589 being exploited in the wild.

**How severe is CVE-2023-30589?** Low severity, with a CVSS score of 3.1, published 1 July 2023.

**Which products and versions are affected?** Nodejs Node.Js v16, v18, v20; llhttp (npm) SEMVER:introduced=0,fixed=8.1.1.

**Is there a fix for CVE-2023-30589?** Yes. llhttp (npm): upgrade to 8.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-30589 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-30589?** Check whether you run Nodejs Node.Js or llhttp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- llhttp (npm): upgrade to 8.1.1 or later

  ```sh
  npm install llhttp@8.1.1
  ```


## Technical details

The vulnerability is a protocol compliance flaw in the llhttp parser's HTTP header field delimiter validation. The parser accepts a single CR character as a valid header delimiter instead of strictly requiring CRLF as specified in RFC 7230 Section 3. This allows an attacker to craft malformed HTTP requests that may be interpreted differently by proxies, caches, or backend servers, enabling HTTP request smuggling attacks. No authentication or user interaction is required; the attack is triggered by sending a specially crafted HTTP request over the network. An attacker can exploit this to inject unauthorized requests, bypass security filters, or poison web caches. The vulnerability was fixed in llhttp v8.1.1.

## Affected products

- nodejs llhttp before 8.1.1
- nodejs Node.js v16, v18, v20

## Identifiers

- CVE-2023-30589
- GHSA-cggh-pq45-6h9x

## Timeline

- 2023-07-01: disclosed: Vulnerability published
- 2023-07-01: patched: llhttp v8.1.1 released with fix

## References

- [https://hackerone.com/reports/2001873](https://hackerone.com/reports/2001873)

## Related threats

- [llhttp HTTP request smuggling via flawed Transfer-Encoding parsing](https://junglewise.ai/threats/cve-2022-32213-llhttp-http-request-smuggling-via-flawed-transfer-encoding)
- [llhttp HTTP Request Smuggling via improper header delimiting](https://junglewise.ai/threats/cve-2022-32214-llhttp-http-request-smuggling-via-improper-header-delimiting)
- [Node.js tar arbitrary file write via symlink attack](https://junglewise.ai/threats/cve-2015-8860-node-js-tar-arbitrary-file-write-via-symlink-attack)
- [Node.js semver Regular Expression Denial of Service](https://junglewise.ai/threats/cve-2015-8855-node-js-semver-regular-expression-denial-of-service)
- [Node.js validator XSS filter bypass via hex encoding](https://junglewise.ai/threats/cve-2014-9772-node-js-validator-xss-filter-bypass-via-hex-encoding)