CVE-2023-30589

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jul 1, 2023
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-30599.8A vulnerability, which was classified as critical, was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown part CVE-2023-305907.5The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only gener CVE-2023-305917.5Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `event CVE-2023-30605.4A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as problematic. This vulnerability affects CVE-2023-306017.8Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra CVE-2023-306027.5Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this v CVE-2023-306039.8Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to chang CVE-2023-306049.8It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technologies CODA-5310. An u CVE-2023-306056.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-306064.9Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary met CVE-2023-306078.8icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field co CVE-2023-306087.5sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnera