Skip to content
OpenAdvisories

Package · npm

llhttp

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2023-30589

    llhttp vulnerable to HTTP request smuggling

    The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…

    nodejs node openjdk17 nodejs Debian Alpine npm