CVE-2025-23167

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers an event-driven, non-blocking I/O model that makes it lightweight and efficient, and is widely used in server-side applications.

‍

A flaw in Node.js HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. This vulnerability affects users prior to the llhttp v9 upgrade.

‍

This vulnerability affects specific versions of the package and can result in denial of service. Details on affected versions and reproduction steps are provided below.

‍

Details

Module Info

• ‍Affected packages: Node.js‍
• Affected versions: 4.0 < 20.19.1‍
• GitHub repository: https://github.com/nodejs/node‍
• Published packages: https://github.com/nodejs/node/releases‍
• Package manager: npm‍
• Fixed in: Node.js NES version 14, 16, 18
  

‍

Mitigation

This vulnerability is not fixed upstream due to the release line being EOL. Herodevs has issued patched builds under the NES (Never Ending Support) line.

- Update to a LTS version of Node.js

- Leverage a commercial support partner like HeroDevs for post-EOL security.

‍

Refer to the NES Documentation for upgrade instructions.

‍

Credits

- kenballus