HTTP request smuggling In nodejs
Description
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS).
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.16 | =10.13.0-r0 || =10.14.0-r0 || =10.14.1-r0 || =10.14.2-r0 || =10.15.1-r0 || =10.15.3-r0 || =10.16.0-r0 || =10.16.1-r0 || =10.16.2-r0 || =10.16.3-r0 || =12.13.0-r0 || =12.13.0-r1 || =12.13.1-r0 || =12.14.0-r0 || =12.14.1-r0 || =12.15.0-r0 || =12.15.0-r1 || =12.15.0-r2 || =12.16.2-r0 || =12.16.3-r0 || =12.16.3-r1 || =12.17.0-r0 || =12.18.0-r0 || =12.18.0-r1 || =12.18.0-r2 || =12.18.2-r0 || =12.18.3-r0 || =12.18.4-r0 || =12.19.0-r0 || =14.15.1-r0 || =14.15.3-r0 || =14.15.3-r1 || =14.15.3-r2 || =14.15.4-r0 || =14.15.5-r0 || =14.16.0-r0 || =14.16.0-r1 || =14.16.1-r0 || =14.16.1-r1 || =14.16.1-r2 || =14.17.0-r0 || =14.17.1-r0 || =14.17.2-r0 || =14.17.3-r0 || =14.17.4-r0 || =14.17.5-r0 || =14.17.6-r0 || =14.17.6-r1 || =14.18.0-r0 || =14.18.1-r0 || =14.18.1-r1 || =16.13.0-r0 || =16.13.1-r0 || =16.13.1-r1 || =16.13.2-r0 || =16.13.2-r1 || =16.14.2-r0 || =16.14.2-r1 || =16.15.0-r0 || =16.15.0-r1 || =16.16.0-r0 || =4.4.3-r0 || =4.4.4-r0 || =4.4.5-r0 || =4.4.7-r0 || =4.5.0-r0 || =6.10.0-r0 || =6.10.1-r0 || =6.10.3-r0 || =6.11.0-r0 || =6.11.1-r0 || =6.11.1-r1 || =6.11.1-r2 || =6.11.2-r0 || =6.11.3-r0 || =6.11.4-r0 || =6.11.5-r0 || =6.9.1-r0 || =6.9.1-r1 || =6.9.2-r0 || =6.9.4-r0 || =6.9.4-r1 || =6.9.5-r0 || =6.9.5-r1 || =8.10.0-r0 || =8.11.0-r0 || =8.11.0-r1 || =8.11.1-r0 || =8.11.1-r1 || =8.11.1-r2 || =8.11.2-r0 || =8.11.3-r0 || =8.11.3-r1 || =8.11.3-r2 || =8.11.3-r3 || =8.11.4-r0 || =8.12.0-r0 || =8.9.0-r0 || =8.9.1-r0 || =8.9.2-r0 || =8.9.3-r0 || =8.9.3-r1 || =8.9.4-r0 || >=0 <16.17.1-r0 | 16.17.1-r0 | |
alpine v3.13 | =10.13.0-r0 || =10.14.0-r0 || =10.14.1-r0 || =10.14.2-r0 || =10.15.1-r0 || =10.15.3-r0 || =10.16.0-r0 || =10.16.1-r0 || =10.16.2-r0 || =10.16.3-r0 || =12.13.0-r0 || =12.13.0-r1 || =12.13.1-r0 || =12.14.0-r0 || =12.14.1-r0 || =12.15.0-r0 || =12.15.0-r1 || =12.15.0-r2 || =12.16.2-r0 || =12.16.3-r0 || =12.16.3-r1 || =12.17.0-r0 || =12.18.0-r0 || =12.18.0-r1 || =12.18.0-r2 || =12.18.2-r0 || =12.18.3-r0 || =12.18.4-r0 || =12.19.0-r0 || =14.15.1-r0 || =14.15.3-r0 || =14.15.3-r1 || =14.15.3-r2 || =14.15.4-r0 || =14.15.5-r0 || =14.16.0-r0 || =14.16.1-r0 || =14.16.1-r1 || =14.17.3-r0 || =14.17.4-r0 || =14.17.5-r0 || =14.17.6-r0 || =14.18.1-r0 || =14.19.0-r0 || =14.20.0-r0 || =4.4.3-r0 || =4.4.4-r0 || =4.4.5-r0 || =4.4.7-r0 || =4.5.0-r0 || =6.10.0-r0 || =6.10.1-r0 || =6.10.3-r0 || =6.11.0-r0 || =6.11.1-r0 || =6.11.1-r1 || =6.11.1-r2 || =6.11.2-r0 || =6.11.3-r0 || =6.11.4-r0 || =6.11.5-r0 || =6.9.1-r0 || =6.9.1-r1 || =6.9.2-r0 || =6.9.4-r0 || =6.9.4-r1 || =6.9.5-r0 || =6.9.5-r1 || =8.10.0-r0 || =8.11.0-r0 || =8.11.0-r1 || =8.11.1-r0 || =8.11.1-r1 || =8.11.1-r2 || =8.11.2-r0 || =8.11.3-r0 || =8.11.3-r1 || =8.11.3-r2 || =8.11.3-r3 || =8.11.4-r0 || =8.12.0-r0 || =8.9.0-r0 || =8.9.1-r0 || =8.9.2-r0 || =8.9.3-r0 || =8.9.3-r1 || =8.9.4-r0 || >=0 <14.20.1-r0 | 14.20.1-r0 | |
alpine v3.15 | =10.13.0-r0 || =10.14.0-r0 || =10.14.1-r0 || =10.14.2-r0 || =10.15.1-r0 || =10.15.3-r0 || =10.16.0-r0 || =10.16.1-r0 || =10.16.2-r0 || =10.16.3-r0 || =12.13.0-r0 || =12.13.0-r1 || =12.13.1-r0 || =12.14.0-r0 || =12.14.1-r0 || =12.15.0-r0 || =12.15.0-r1 || =12.15.0-r2 || =12.16.2-r0 || =12.16.3-r0 || =12.16.3-r1 || =12.17.0-r0 || =12.18.0-r0 || =12.18.0-r1 || =12.18.0-r2 || =12.18.2-r0 || =12.18.3-r0 || =12.18.4-r0 || =12.19.0-r0 || =14.15.1-r0 || =14.15.3-r0 || =14.15.3-r1 || =14.15.3-r2 || =14.15.4-r0 || =14.15.5-r0 || =14.16.0-r0 || =14.16.0-r1 || =14.16.1-r0 || =14.16.1-r1 || =14.16.1-r2 || =14.17.0-r0 || =14.17.1-r0 || =14.17.2-r0 || =14.17.3-r0 || =14.17.4-r0 || =14.17.5-r0 || =14.17.6-r0 || =14.17.6-r1 || =14.18.0-r0 || =14.18.1-r0 || =14.18.1-r1 || =16.13.0-r0 || =16.13.1-r0 || =16.13.2-r0 || =16.14.0-r0 || =16.14.2-r0 || =16.16.0-r0 || =4.4.3-r0 || =4.4.4-r0 || =4.4.5-r0 || =4.4.7-r0 || =4.5.0-r0 || =6.10.0-r0 || =6.10.1-r0 || =6.10.3-r0 || =6.11.0-r0 || =6.11.1-r0 || =6.11.1-r1 || =6.11.1-r2 || =6.11.2-r0 || =6.11.3-r0 || =6.11.4-r0 || =6.11.5-r0 || =6.9.1-r0 || =6.9.1-r1 || =6.9.2-r0 || =6.9.4-r0 || =6.9.4-r1 || =6.9.5-r0 || =6.9.5-r1 || =8.10.0-r0 || =8.11.0-r0 || =8.11.0-r1 || =8.11.1-r0 || =8.11.1-r1 || =8.11.1-r2 || =8.11.2-r0 || =8.11.3-r0 || =8.11.3-r1 || =8.11.3-r2 || =8.11.3-r3 || =8.11.4-r0 || =8.12.0-r0 || =8.9.0-r0 || =8.9.1-r0 || =8.9.2-r0 || =8.9.3-r0 || =8.9.3-r1 || =8.9.4-r0 || >=0 <16.17.1-r0 | 16.17.1-r0 | |
 npm | >=0 <6.0.7 | 6.0.7 | |
alpine v3.17 | =10.13.0-r0 || =10.14.0-r0 || =10.14.1-r0 || =10.14.2-r0 || =10.15.1-r0 || =10.15.3-r0 || =10.16.0-r0 || =10.16.1-r0 || =10.16.2-r0 || =10.16.3-r0 || =12.13.0-r0 || =12.13.0-r1 || =12.13.1-r0 || =12.14.0-r0 || =12.14.1-r0 || =12.15.0-r0 || =12.15.0-r1 || =12.15.0-r2 || =12.16.2-r0 || =12.16.3-r0 || =12.16.3-r1 || =12.17.0-r0 || =12.18.0-r0 || =12.18.0-r1 || =12.18.0-r2 || =12.18.2-r0 || =12.18.3-r0 || =12.18.4-r0 || =12.19.0-r0 || =14.15.1-r0 || =14.15.3-r0 || =14.15.3-r1 || =14.15.3-r2 || =14.15.4-r0 || =14.15.5-r0 || =14.16.0-r0 || =14.16.0-r1 || =14.16.1-r0 || =14.16.1-r1 || =14.16.1-r2 || =14.17.0-r0 || =14.17.1-r0 || =14.17.2-r0 || =14.17.3-r0 || =14.17.4-r0 || =14.17.5-r0 || =14.17.6-r0 || =14.17.6-r1 || =14.18.0-r0 || =14.18.1-r0 || =14.18.1-r1 || =16.13.0-r0 || =16.13.1-r0 || =16.13.1-r1 || =16.13.2-r0 || =16.13.2-r1 || =16.14.2-r0 || =16.14.2-r1 || =16.15.0-r0 || =16.15.0-r1 || =16.16.0-r0 || =16.16.0-r1 || =16.17.0-r0 || =4.4.3-r0 || =4.4.4-r0 || =4.4.5-r0 || =4.4.7-r0 || =4.5.0-r0 || =6.10.0-r0 || =6.10.1-r0 || =6.10.3-r0 || =6.11.0-r0 || =6.11.1-r0 || =6.11.1-r1 || =6.11.1-r2 || =6.11.2-r0 || =6.11.3-r0 || =6.11.4-r0 || =6.11.5-r0 || =6.9.1-r0 || =6.9.1-r1 || =6.9.2-r0 || =6.9.4-r0 || =6.9.4-r1 || =6.9.5-r0 || =6.9.5-r1 || =8.10.0-r0 || =8.11.0-r0 || =8.11.0-r1 || =8.11.1-r0 || =8.11.1-r1 || =8.11.1-r2 || =8.11.2-r0 || =8.11.3-r0 || =8.11.3-r1 || =8.11.3-r2 || =8.11.3-r3 || =8.11.4-r0 || =8.12.0-r0 || =8.9.0-r0 || =8.9.1-r0 || =8.9.2-r0 || =8.9.3-r0 || =8.9.3-r1 || =8.9.4-r0 || >=0 <16.17.1-r0 | 16.17.1-r0 | |
alpine v3.18 | =10.13.0-r0 || =10.14.0-r0 || =10.14.1-r0 || =10.14.2-r0 || =10.15.1-r0 || =10.15.3-r0 || =10.16.0-r0 || =10.16.1-r0 || =10.16.2-r0 || =10.16.3-r0 || =12.13.0-r0 || =12.13.0-r1 || =12.13.1-r0 || =12.14.0-r0 || =12.14.1-r0 || =12.15.0-r0 || =12.15.0-r1 || =12.15.0-r2 || =12.16.2-r0 || =12.16.3-r0 || =12.16.3-r1 || =12.17.0-r0 || =12.18.0-r0 || =12.18.0-r1 || =12.18.0-r2 || =12.18.2-r0 || =12.18.3-r0 || =12.18.4-r0 || =12.19.0-r0 || =14.15.1-r0 || =14.15.3-r0 || =14.15.3-r1 || =14.15.3-r2 || =14.15.4-r0 || =14.15.5-r0 || =14.16.0-r0 || =14.16.0-r1 || =14.16.1-r0 || =14.16.1-r1 || =14.16.1-r2 || =14.17.0-r0 || =14.17.1-r0 || =14.17.2-r0 || =14.17.3-r0 || =14.17.4-r0 || =14.17.5-r0 || =14.17.6-r0 || =14.17.6-r1 || =14.18.0-r0 || =14.18.1-r0 || =14.18.1-r1 || =16.13.0-r0 || =16.13.1-r0 || =16.13.1-r1 || =16.13.2-r0 || =16.13.2-r1 || =16.14.2-r0 || =16.14.2-r1 || =16.15.0-r0 || =16.15.0-r1 || =16.16.0-r0 || =16.16.0-r1 || =16.17.0-r0 || =4.4.3-r0 || =4.4.4-r0 || =4.4.5-r0 || =4.4.7-r0 || =4.5.0-r0 || =6.10.0-r0 || =6.10.1-r0 || =6.10.3-r0 || =6.11.0-r0 || =6.11.1-r0 || =6.11.1-r1 || =6.11.1-r2 || =6.11.2-r0 || =6.11.3-r0 || =6.11.4-r0 || =6.11.5-r0 || =6.9.1-r0 || =6.9.1-r1 || =6.9.2-r0 || =6.9.4-r0 || =6.9.4-r1 || =6.9.5-r0 || =6.9.5-r1 || =8.10.0-r0 || =8.11.0-r0 || =8.11.0-r1 || =8.11.1-r0 || =8.11.1-r1 || =8.11.1-r2 || =8.11.2-r0 || =8.11.3-r0 || =8.11.3-r1 || =8.11.3-r2 || =8.11.3-r3 || =8.11.4-r0 || =8.12.0-r0 || =8.9.0-r0 || =8.9.1-r0 || =8.9.2-r0 || =8.9.3-r0 || =8.9.3-r1 || =8.9.4-r0 || >=0 <16.17.1-r0 | 16.17.1-r0 | |
alpine v3.19 | =10.13.0-r0 || =10.14.0-r0 || =10.14.1-r0 || =10.14.2-r0 || =10.15.1-r0 || =10.15.3-r0 || =10.16.0-r0 || =10.16.1-r0 || =10.16.2-r0 || =10.16.3-r0 || =12.13.0-r0 || =12.13.0-r1 || =12.13.1-r0 || =12.14.0-r0 || =12.14.1-r0 || =12.15.0-r0 || =12.15.0-r1 || =12.15.0-r2 || =12.16.2-r0 || =12.16.3-r0 || =12.16.3-r1 || =12.17.0-r0 || =12.18.0-r0 || =12.18.0-r1 || =12.18.0-r2 || =12.18.2-r0 || =12.18.3-r0 || =12.18.4-r0 || =12.19.0-r0 || =14.15.1-r0 || =14.15.3-r0 || =14.15.3-r1 || =14.15.3-r2 || =14.15.4-r0 || =14.15.5-r0 || =14.16.0-r0 || =14.16.0-r1 || =14.16.1-r0 || =14.16.1-r1 || =14.16.1-r2 || =14.17.0-r0 || =14.17.1-r0 || =14.17.2-r0 || =14.17.3-r0 || =14.17.4-r0 || =14.17.5-r0 || =14.17.6-r0 || =14.17.6-r1 || =14.18.0-r0 || =14.18.1-r0 || =14.18.1-r1 || =16.13.0-r0 || =16.13.1-r0 || =16.13.1-r1 || =16.13.2-r0 || =16.13.2-r1 || =16.14.2-r0 || =16.14.2-r1 || =16.15.0-r0 || =16.15.0-r1 || =16.16.0-r0 || =16.16.0-r1 || =16.17.0-r0 || =4.4.3-r0 || =4.4.4-r0 || =4.4.5-r0 || =4.4.7-r0 || =4.5.0-r0 || =6.10.0-r0 || =6.10.1-r0 || =6.10.3-r0 || =6.11.0-r0 || =6.11.1-r0 || =6.11.1-r1 || =6.11.1-r2 || =6.11.2-r0 || =6.11.3-r0 || =6.11.4-r0 || =6.11.5-r0 || =6.9.1-r0 || =6.9.1-r1 || =6.9.2-r0 || =6.9.4-r0 || =6.9.4-r1 || =6.9.5-r0 || =6.9.5-r1 || =8.10.0-r0 || =8.11.0-r0 || =8.11.0-r1 || =8.11.1-r0 || =8.11.1-r1 || =8.11.1-r2 || =8.11.2-r0 || =8.11.3-r0 || =8.11.3-r1 || =8.11.3-r2 || =8.11.3-r3 || =8.11.4-r0 || =8.12.0-r0 || =8.9.0-r0 || =8.9.1-r0 || =8.9.2-r0 || =8.9.3-r0 || =8.9.3-r1 || =8.9.4-r0 || >=0 <16.17.1-r0 | 16.17.1-r0 | |
alpine v3.20 | =10.13.0-r0 || =10.14.0-r0 || =10.14.1-r0 || =10.14.2-r0 || =10.15.1-r0 || =10.15.3-r0 || =10.16.0-r0 || =10.16.1-r0 || =10.16.2-r0 || =10.16.3-r0 || =12.13.0-r0 || =12.13.0-r1 || =12.13.1-r0 || =12.14.0-r0 || =12.14.1-r0 || =12.15.0-r0 || =12.15.0-r1 || =12.15.0-r2 || =12.16.2-r0 || =12.16.3-r0 || =12.16.3-r1 || =12.17.0-r0 || =12.18.0-r0 || =12.18.0-r1 || =12.18.0-r2 || =12.18.2-r0 || =12.18.3-r0 || =12.18.4-r0 || =12.19.0-r0 || =14.15.1-r0 || =14.15.3-r0 || =14.15.3-r1 || =14.15.3-r2 || =14.15.4-r0 || =14.15.5-r0 || =14.16.0-r0 || =14.16.0-r1 || =14.16.1-r0 || =14.16.1-r1 || =14.16.1-r2 || =14.17.0-r0 || =14.17.1-r0 || =14.17.2-r0 || =14.17.3-r0 || =14.17.4-r0 || =14.17.5-r0 || =14.17.6-r0 || =14.17.6-r1 || =14.18.0-r0 || =14.18.1-r0 || =14.18.1-r1 || =16.13.0-r0 || =16.13.1-r0 || =16.13.1-r1 || =16.13.2-r0 || =16.13.2-r1 || =16.14.2-r0 || =16.14.2-r1 || =16.15.0-r0 || =16.15.0-r1 || =16.16.0-r0 || =16.16.0-r1 || =16.17.0-r0 || =4.4.3-r0 || =4.4.4-r0 || =4.4.5-r0 || =4.4.7-r0 || =4.5.0-r0 || =6.10.0-r0 || =6.10.1-r0 || =6.10.3-r0 || =6.11.0-r0 || =6.11.1-r0 || =6.11.1-r1 || =6.11.1-r2 || =6.11.2-r0 || =6.11.3-r0 || =6.11.4-r0 || =6.11.5-r0 || =6.9.1-r0 || =6.9.1-r1 || =6.9.2-r0 || =6.9.4-r0 || =6.9.4-r1 || =6.9.5-r0 || =6.9.5-r1 || =8.10.0-r0 || =8.11.0-r0 || =8.11.0-r1 || =8.11.1-r0 || =8.11.1-r1 || =8.11.1-r2 || =8.11.2-r0 || =8.11.3-r0 || =8.11.3-r1 || =8.11.3-r2 || =8.11.3-r3 || =8.11.4-r0 || =8.12.0-r0 || =8.9.0-r0 || =8.9.1-r0 || =8.9.2-r0 || =8.9.3-r0 || =8.9.3-r1 || =8.9.4-r0 || >=0 <16.17.1-r0 | 16.17.1-r0 | |
alpine v3.21 | >=0 <16.17.1-r0 | 16.17.1-r0 | |
alpine v3.22 | >=0 <16.17.1-r0 | 16.17.1-r0 |
1-10 of 19
10
Aliases
References
1. https://github.com/nodejs/llhttp/commit/18a4afc7ffb4e49dc9e2daebc50588199a6d1dbb2. https://hackerone.com/reports/15246923. https://datatracker.ietf.org/doc/html/rfc7230#section-34. https://nodejs.org/en/blog/vulnerability/july-2022-security-releases5. https://security.netapp.com/advisory/ntap-20220915-00016. https://www.debian.org/security/2023/dsa-5326
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.