CVE-2025-23167
Description
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`.
This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.
The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.
Impact:
* This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.
CWE
- CWE-444 — CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Affected
- nodejs / node — v=4.0 <4.* [affected]; v=5.0 <5.* [affected]; v=6.0 <6.* [affected]; v=7.0 <7.* [affected]; v=8.0 <8.* [affected]; v=9.0 <9.* [affected]; v=10.0 <10.* [affected]; v=11.0 <11.* [affected]; v=12.0 <12.* [affected]; v=13.0 <13.* [affected]; v=14.0 <14.* [affected]; v=15.0 <15.* [affected]; v=16.0 <16.* [affected]; v=17.0 <17.* [affected]; v=18.0 <18.* [affected]; v=19.0 <19.* [affected]; v=20.0 ≤20.19.1 [affected]
CVSS
- 3.0 score=6.5 severity=MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
Source
cvelistV5-main/cves/2025/23xxx/CVE-2025-23167.json