CVE-2025-53094: ESPAsyncWebServer CRLF Injection XSS Flaw

CVE-2025-53094 Overview

CVE-2025-53094 is a Carriage Return Line Feed (CRLF) injection vulnerability in ESPAsyncWebServer, an asynchronous HTTP and WebSocket server library used on ESP32, ESP8266, RP2040, and RP2350 microcontrollers. The flaw resides in AsyncWebHeader.cpp, where unsanitized input is incorporated into HTTP header names and values. Attackers can inject \r and \n characters to manipulate headers, split responses, and inject arbitrary content. The issue affects all versions up to and including 3.7.8 and is tracked under [CWE-93: Improper Neutralization of CRLF Sequences]. A fix has been merged in pull request 211 and is expected in release 3.7.9.

Critical Impact
Remote, unauthenticated attackers can manipulate HTTP responses on millions of IoT and embedded devices using ESPAsyncWebServer, enabling header injection, response splitting, and downstream attacks.

Affected Products

ESPAsyncWebServer versions ≤ 3.7.8 on ESP32
ESPAsyncWebServer versions ≤ 3.7.8 on ESP8266
ESPAsyncWebServer versions ≤ 3.7.8 on RP2040 and RP2350

Discovery Timeline

2025-06-27 - CVE-2025-53094 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-53094

Vulnerability Analysis

The vulnerability stems from missing input sanitization when ESPAsyncWebServer constructs HTTP response headers. The AsyncWebHeader class accepts header names and values without filtering control characters such as \r (0x0D) and \n (0x0A). When a request parameter or other attacker-controlled value is reflected into a header, those characters terminate the current header line and allow attackers to inject arbitrary additional headers or an entire response body.

This class of issue is commonly known as HTTP response splitting. Because ESPAsyncWebServer is widely embedded in IoT firmware, smart home devices, and industrial sensors, the exposure surface extends to any internet-reachable or LAN-reachable device running an affected firmware build. The vulnerability requires no authentication and no user interaction.

Root Cause

The defect resides in the header construction logic in AsyncWebHeader.cpp. The constructor and serialization routines treat header names and values as opaque strings and concatenate them with : and \r\n separators without rejecting or escaping embedded CRLF sequences. Any caller that passes user-controlled data — for example, an echoed cookie, redirect target, or custom header — propagates the unsanitized characters directly into the wire format.

Attack Vector

An attacker submits an HTTP request containing CR or LF bytes in a field that the application reflects into a response header. The injected bytes close the original header line and introduce attacker-defined headers such as Set-Cookie, Location, or Content-Length. Depending on the application, this enables session fixation, open redirects, cache poisoning of upstream proxies, and cross-site scripting through injected response bodies. Detailed code references are available in the ESPAsyncWebServer security advisory GHSA-87j8-6f7g-h8wh and the vulnerable source in AsyncWebHeader.cpp.

Detection Methods for CVE-2025-53094

Indicators of Compromise

HTTP request logs containing URL-encoded CR (%0D) or LF (%0A) sequences in query parameters, cookies, or custom header values directed at ESP32, ESP8266, or RP2040 devices.
Unexpected Set-Cookie, Location, or Content-Type headers appearing in responses from embedded web interfaces.
Anomalous response bodies that contain HTML or script content from endpoints that normally return JSON or plain text.

Detection Strategies

Inspect HTTP traffic to and from IoT devices for raw or encoded CRLF byte sequences inside header-bound parameters.
Fingerprint web servers on the network using the Server header and inventory devices identifying as ESPAsyncWebServer along with firmware versions.
Apply web application firewall rules that block requests containing CRLF characters in parameters that map to response headers.

Monitoring Recommendations

Capture and review reverse proxy logs in front of ESP-based devices for malformed responses, duplicate headers, or unexpected HTTP/1.1 status lines mid-response.
Alert on outbound traffic from segmented IoT VLANs that includes HTTP responses with multiple Content-Length or Transfer-Encoding headers.
Track firmware version metadata in asset inventory to identify devices still running ESPAsyncWebServer 3.7.8 or earlier.

How to Mitigate CVE-2025-53094

Immediate Actions Required

Upgrade ESPAsyncWebServer to version 3.7.9 or later once released, which incorporates pull request 211.
Audit firmware projects for direct use of AsyncWebHeader with user-controlled inputs and add server-side validation that rejects CR and LF bytes.
Restrict network exposure of affected devices to trusted management networks until patched firmware is deployed.

Patch Information

The maintainers have merged a fix in pull request 211, which sanitizes header names and values before serialization. The fix is expected to ship in ESPAsyncWebServer version 3.7.9. Device vendors that bundle ESPAsyncWebServer must rebuild and redistribute firmware that includes the patched library.

Workarounds

Place affected devices behind a reverse proxy or web application firewall that strips CRLF sequences from request parameters and validates response headers.
Modify application code to validate any value passed to AsyncWebServerResponse::addHeader() and reject inputs containing \r or \n.
Disable or remove web interfaces on devices where the HTTP server is not strictly required.

bash

# Example WAF rule fragment to block CRLF in query parameters
# (ModSecurity-style pseudo-rule)
SecRule ARGS "@rx (?:%0[ad]|\r|\n)" \
    "id:1005309,phase:2,deny,status:400,\
     msg:'CRLF injection attempt against ESPAsyncWebServer (CVE-2025-53094)'"