CVE-2023-30589: XSS
Last updated 24 July 2024
Other sources
Node.js is vulnerable to HTTP request smuggling, caused by the failure to strictly use the CRLF sequence to delimit HTTP requests by the llhttp parser in the http module. By sending specially crafted HTTP request headers, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
— GitHub
The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
References: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-30589?
CVE-2023-30589 is a vulnerability in the llhttp parser in the http module in Node v20.2.0 that can lead to HTTP Request Smuggling (HRS).
How does CVE-2023-30589 affect Node.js?
CVE-2023-30589 affects Node.js versions 16.0.0, 18.0.0, 20.0.0, and 20.2.0.
What is the severity of CVE-2023-30589?
CVE-2023-30589 has a severity rating of high.
How can I fix CVE-2023-30589?
To fix CVE-2023-30589, update the llhttp package to version 8.1.1 or higher.
Where can I find more information about CVE-2023-30589?
You can find more information about CVE-2023-30589 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-30589), [HackerOne](https://hackerone.com/reports/2001873), [GitHub](https://github.com/nodejs/llhttp/releases/tag/release%2Fv8.1.1).