HighFix available
nodejs — security advisory
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
- Products
- nodejs
- Affected versions
- 18.13.0+dfsg1-1, 18.13.0+dfsg1-1.1, 18.19.0+dfsg-1, 18.19.0+dfsg-2, 18.19.0+dfsg-3, 18.19.0+dfsg-4, 18.19.0+dfsg-5
- Fixed versions
- 18.13.0+dfsg1-1.1, 18.19.0+dfsg-6~deb12u1
- CVEs
- CVE-2023-30589
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 11:09 UTC · Revision 1
Source evidence
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
osv:DEBIAN-CVE-2023-30589
nodejs
Fixed versions: 18.19.0+dfsg-6~deb12u1
nodejs
Fixed versions: 18.13.0+dfsg1-1.1
nodejs
Fixed versions: 18.13.0+dfsg1-1.1
Complete source record
{
"id": "0f97e6ade3f173ca877f622441a365ec8c3f9ff34d0e5cbdb709c0b700eab7b5",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2023-30589",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2023-30589",
"summary": "The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20",
"evidence": "osv:DEBIAN-CVE-2023-30589",
"products": [
{
"name": {
"value": "nodejs",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "18.19.0+dfsg-6~deb12u1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "18.13.0+dfsg1-1",
"evidence": "/affected/0/versions"
},
{
"value": "18.13.0+dfsg1-1.1",
"evidence": "/affected/0/versions"
},
{
"value": "18.19.0+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "18.19.0+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "18.19.0+dfsg-3",
"evidence": "/affected/0/versions"
},
{
"value": "18.19.0+dfsg-4",
"evidence": "/affected/0/versions"
},
{
"value": "18.19.0+dfsg-5",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "nodejs",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "18.13.0+dfsg1-1.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "18.13.0+dfsg1-1.1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2023-30589",
"aliases": [
"DEBIAN-CVE-2023-30589"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "18.19.0+dfsg-6~deb12u1"
}
]
}
],
"package": {
"name": "nodejs",
"purl": "pkg:deb/debian/nodejs?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"18.13.0+dfsg1-1",
"18.13.0+dfsg1-1.1",
"18.19.0+dfsg-1",
"18.19.0+dfsg-2",
"18.19.0+dfsg-3",
"18.19.0+dfsg-4",
"18.19.0+dfsg-5"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-30589.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "18.13.0+dfsg1-1.1"
}
]
}
],
"package": {
"name": "nodejs",
"purl": "pkg:deb/debian/nodejs?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-30589.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "18.13.0+dfsg1-1.1"
}
]
}
],
"package": {
"name": "nodejs",
"purl": "pkg:deb/debian/nodejs?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-30589.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-09T09:47:36.563087547Z",
"provider": "osv",
"upstream": [
"CVE-2023-30589"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2023-30589"
]
},
"related_cves": [
{
"value": "CVE-2023-30589",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 111712,
"published_at": "2023-07-01T00:15:10.293+00:00"
}