Node.js 20.x HTTP Parser Vulnerability in node-undici: Request Smuggling Risk
Summary
CVE-2025-23167: A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. Affects node-undici versions 5.15.0+dfsg1+~cs20.10.9.3-1 – 7.3.0+dfsg1+~cs24.12.11-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-undici is a popular HTTP client for Node.js, designed to provide a high-performance and efficient way to make HTTP requests. It is widely used in various applications due to its non-blocking nature and support for modern HTTP features. However, a vulnerability in Node.js 20's HTTP parser has been identified, which affects the way HTTP/1 headers are terminated, potentially leading to serious security risks.
Vulnerability Detail
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using '\r\n\rX' instead of the required '\r\n\r\n'. This inconsistency can lead to request smuggling, enabling attackers to bypass proxy-based access controls and submit unauthorized requests. The vulnerability specifically affects Node.js 20.x users prior to the upgrade of the llhttp library to version 9, which enforces correct header termination.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your application does not rely on the affected HTTP/1 header termination behavior. Implement additional validation on incoming requests to check for proper header formatting, or consider using a different HTTP client that is not affected by this vulnerability until an upgrade can be performed.
Conclusion
The CVE-2025-23167 vulnerability in Node.js 20.x's HTTP parser poses a significant risk of request smuggling, allowing unauthorized requests to bypass access controls. Users of the node-undici package should promptly upgrade to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-undici →
FAQ
The impact includes the potential for attackers to bypass access controls and submit unauthorized requests, which can lead to data breaches or other malicious activities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Only Node.js 20.x users prior to the llhttp v9 upgrade are affected by this vulnerability.
Request smuggling is a technique used by attackers to send multiple HTTP requests in a way that confuses the server and allows unauthorized actions to be performed.
Yes, upgrading the llhttp library to version 9 resolves the vulnerability. Ensure to update your node-undici package to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for node-undici.
