CVE-2023-30589
Last modified
CVE-2023-30589 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. EPSS estimates a 3.91% chance of exploitation in the next 30 days.
Description
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Node.Js | >= 16.0.0, < 16.20.1 |
| Nodejs | Node.Js | >= 18.0.0, < 18.16.1 |
| Nodejs | Node.Js | >= 20.0.0, < 20.3.1 |
| Fedoraproject | Fedora | 37 |
| Fedoraproject | Fedora | 38 |
References
- https://hackerone.com/reports/2001873Exploit, Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230803-0009/Third Party Advisory
- https://hackerone.com/reports/2001873Exploit, Issue Tracking, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230803-0009/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-30589?
How severe is CVE-2023-30589?
How do I fix CVE-2023-30589?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-30583fs.openAsBlob() can bypass the experimental permission model…7.5
- CVE-2023-30584A vulnerability has been discovered in Node.js version 20, s…7.7
- CVE-2023-30585A vulnerability has been identified in the Node.js (.msi ver…7.5
- CVE-2023-30586A privilege escalation vulnerability exists in Node.js 20 th…7.5
- CVE-2023-30587A vulnerability in Node.js version 20 allows for bypassing r…7.5
- CVE-2023-30588When an invalid public key is used to create an x509 certifi…5.3
- CVE-2023-3059A vulnerability, which was classified as critical, was found…9.8
- CVE-2023-30590The generateKeys() API function returned from crypto.createD…7.5
- CVE-2023-30591Denial-of-service in NodeBB <= v2.8.10 allows unauthenticate…7.5
- CVE-2023-3060A vulnerability has been found in code-projects Agro-School …5.4
- CVE-2023-30601Privilege escalation when enabling FQL/Audit logs allows use…7.8
- CVE-2023-30602Hitron Technologies CODA-5310’s Telnet function transfers se…7.5
Are you affected by CVE-2023-30589?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST