CVE-2023-30589: Node.js HTTP Request Smuggling Vulnerability

CVE-2023-30589 Overview

CVE-2023-30589 is an HTTP Request Smuggling vulnerability discovered in the llhttp parser within the HTTP module of Node.js. The vulnerability arises because the llhttp parser does not strictly enforce the CRLF (Carriage Return Line Feed) sequence to delimit HTTP requests. Instead, the parser incorrectly accepts a standalone CR character (without LF) as sufficient to delimit HTTP header fields, which violates RFC7230 section 3 specifications that mandate only the CRLF sequence should delimit each header-field.

This parsing inconsistency can be exploited to perform HTTP Request Smuggling (HRS) attacks, where an attacker can manipulate HTTP request boundaries to bypass security controls, poison web caches, or hijack user sessions in environments where Node.js applications sit behind load balancers or reverse proxies.

Critical Impact

HTTP Request Smuggling can lead to bypass of security controls, cache poisoning, session hijacking, and unauthorized access to sensitive data in Node.js web applications.

Affected Products

• Node.js v16 (all active versions)
• Node.js v18 (all active versions)
• Node.js v20 (specifically v20.2.0 and related versions)
• Fedora 37
• Fedora 38

Discovery Timeline

• 2023-07-01 - CVE-2023-30589 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2023-30589

Vulnerability Analysis

The llhttp parser is a core component of Node.js responsible for parsing HTTP/1.x messages. This vulnerability stems from the parser's overly permissive handling of line delimiters in HTTP headers. According to RFC7230, HTTP header fields must be delimited using the CRLF sequence (\r\n), but the vulnerable llhttp parser accepts a bare CR character (\r) without the subsequent LF (\n) as a valid delimiter.

This deviation from the HTTP specification creates a desynchronization opportunity between the Node.js server and any front-end proxies or load balancers that strictly follow RFC7230. When these systems interpret HTTP request boundaries differently, attackers can craft malicious requests that appear as one request to the proxy but are processed as multiple requests by the Node.js backend.

The vulnerability affects the integrity of HTTP request processing, enabling attackers to inject unauthorized requests, bypass authentication mechanisms, or access resources belonging to other users without requiring any special privileges or user interaction.

Root Cause

The root cause lies in the llhttp parser's lenient implementation of HTTP message parsing. The parser was designed to be tolerant of malformed input for backward compatibility, but this tolerance extends to accepting non-compliant line terminators. Specifically, the state machine in llhttp transitions on encountering a CR character alone, rather than waiting for the complete CRLF sequence before considering a header line complete.

This implementation choice violates the principle of being strict in what you send and somewhat liberal in what you receive, as the liberal parsing creates security vulnerabilities when different HTTP intermediaries apply stricter parsing rules.

Attack Vector

HTTP Request Smuggling attacks exploiting CVE-2023-30589 leverage the discrepancy between how front-end proxies and the Node.js backend interpret request boundaries. An attacker sends a specially crafted HTTP request containing CR-only delimiters that the proxy may ignore or interpret differently than Node.js.

The attack typically follows this pattern: A malicious request is constructed where the front-end proxy sees one complete request, while the Node.js server interprets the payload as containing additional embedded requests. This allows the attacker to "smuggle" requests past security controls, potentially accessing restricted endpoints, poisoning caches with malicious content, or hijacking requests from other users.

Since this is a network-based attack requiring no authentication or user interaction, it poses a significant risk to any Node.js application accessible from untrusted networks, particularly those deployed behind reverse proxies or load balancers.

Detection Methods for CVE-2023-30589

Indicators of Compromise

• Unusual HTTP requests in server logs containing bare CR characters (\r) without corresponding LF characters
• Unexpected requests appearing to originate from legitimate user sessions
• Cache entries containing unexpected or malicious content
• Web application firewall logs showing request parsing anomalies

Detection Strategies

• Implement network intrusion detection rules to identify HTTP requests with non-standard line terminators
• Monitor for discrepancies between proxy access logs and backend server logs indicating request desynchronization
• Deploy application-layer monitoring to detect unexpected request patterns or session anomalies
• Use HTTP protocol analyzers to identify malformed requests at network ingress points

Monitoring Recommendations

• Enable detailed HTTP request logging on both proxy and Node.js application layers
• Implement correlation analysis between front-end and back-end request logs to identify smuggling attempts
• Configure alerting for unusual request patterns or parsing errors in the llhttp module
• Monitor for cache poisoning indicators such as unexpected content served to users

How to Mitigate CVE-2023-30589

Immediate Actions Required

• Upgrade Node.js to the latest patched version for your active release line (v16.x, v18.x, or v20.x)
• Review and audit any HTTP proxies or load balancers in front of Node.js applications for consistent parsing behavior
• Implement strict HTTP parsing rules at network boundaries where possible
• Consider deploying a Web Application Firewall (WAF) with HTTP normalization capabilities

Patch Information

Security patches addressing this vulnerability have been released for all affected Node.js active version lines. Users should upgrade to the latest available version within their release line. Additional security advisories have been published by Fedora, NetApp, and Debian with distribution-specific patch information.

The original vulnerability was reported via the HackerOne bug bounty program.

Workarounds

• Configure front-end proxies to normalize HTTP requests by rejecting or sanitizing requests with non-standard line terminators
• Implement strict HTTP parsing at the reverse proxy layer to ensure consistent request interpretation
• Use HTTP/2 for client-to-proxy communication where possible, as HTTP/2 uses a binary framing layer not susceptible to this class of vulnerability
• Deploy network-level filtering to detect and block requests containing bare CR characters in header fields

# Example: Check Node.js version and upgrade
node --version
# If vulnerable, upgrade using your package manager
# For npm-based Node.js version management:
nvm install --lts
nvm use --lts

# Verify the upgrade
node --version