HTTP Request Smuggling Vulnerability in Node.js Package - CVE-2023-30589
Summary
UBUNTU-CVE-2023-30589: The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. Affects nodejs versions < 18.19.1+dfsg-2ubuntu4. Fixed in 18.19.1+dfsg-2ubuntu4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The Node.js package, particularly the http module, is crucial for handling HTTP requests and responses. However, a vulnerability has been identified in the llhttp parser of Node.js, which can lead to serious security issues.
Vulnerability Detail
The llhttp parser in the http module of Node.js versions 16, 18, and 20 does not strictly enforce the CRLF sequence for delimiting HTTP requests. This deviation from the RFC7230 specification can lead to HTTP Request Smuggling (HRS), allowing attackers to manipulate HTTP requests and potentially gain unauthorized access or disrupt service. The vulnerability arises from the parser's acceptance of a CR character without an LF, which is not compliant with the expected standards.
How To Fix
Minimum fixed version
18.19.1+dfsg-2ubuntu4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application validates and sanitizes HTTP requests before processing them. This can help mitigate the risk of HTTP Request Smuggling until the package is updated.
Conclusion
CVE-2023-30589 represents a significant security risk for applications using the affected versions of Node.js. It is crucial to update to the patched version to mitigate potential threats. Additionally, employing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for nodejs →
FAQ
CVE-2023-30589 is a vulnerability in the Node.js package that allows for HTTP Request Smuggling due to improper handling of CRLF sequences in HTTP requests.
The vulnerability affects Node.js versions 16, 18, and 20.
The vulnerability can lead to unauthorized access, data manipulation, and service disruption through HTTP Request Smuggling.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2023-30589 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
