1. Home
  2. Security Advisories
  3. NPM
  4. NPM:GHSA-CGGH-PQ45-6H9X

[NPM:GHSA-CGGH-PQ45-6H9X] llhttp vulnerable to HTTP request smuggling

Severity High
Affected Packages 1
Fixed Packages 1
CVEs 1
Info Packages References Vulnerabilities

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Package Affected Version
pkg:npm/llhttp < 8.1.1
Package Fixed Version
pkg:npm/llhttp = 8.1.1
ID
NPM:GHSA-CGGH-PQ45-6H9X
Severity
high
URL
https://github.com/advisories/GHSA-cggh-pq45-6h9x
Published
2023-07-01T00:30:46
(14 months ago)
Modified
2023-11-11T05:06:22
(10 months ago)
Rights
NPM Security Team
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:npm/llhttp llhttp < 8.1.1
Fixed pkg:npm/llhttp llhttp = 8.1.1
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date