The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3 only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16 v18 and v20

🗓️ 01 Jul 2023 07:00:00Reported by MicrosoftType

llhttp parser uses CR not CRLF, enabling HTTP Request Smuggling in Node.js versions sixteen, eighteen, and twenty.

Reporter	Title	Published	Views	Family All 225
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Node.js	27 Sep 202321:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to multiple vulnerabilities	2 Oct 202410:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to several vulnerabilities in Node.js due to [CVE-2023-30581] [CVE-2023-30588] [CVE-2023-30589] [CVE-2023-30590]	7 Sep 202315:11	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to permissions bypass, privilege escalation, key generation failure, denial of service and request smuggling due to vulnerabilities in Node.js	18 Aug 202308:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor	26 Sep 202308:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	20 Oct 202317:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.12 and earlier	8 Aug 202322:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affects IBM Voice Gateway	31 Jan 202413:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by multiple vulnerabilities in Node.js	1 Aug 202309:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway vulnerable to multiple issues in Node.js	13 Oct 202312:54	–	ibm

Vulners

Node

microsoft cbl2_nodejs_16.20.1-2Range<16.20.1-2

microsoft cbl2_nodejs18_18.17.1-2Range<18.17.1-2

18 Feb 2026 09:57Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.5

EPSS0.03906