CVE-2025-23167

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact: * This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.

References

Affected packages

Debian:12 / node-undici

Package

Name: node-undici
Purl: pkg:deb/debian/node-undici?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.15.0+dfsg1+~cs20.10.9.3-1

5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1

5.15.0+dfsg1+~cs20.10.9.3-1+deb12u2

5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3

5.15.0+dfsg1+~cs20.10.9.3-1+deb12u4

5.19.1+dfsg1+~cs20.10.9.5-1

5.19.1+dfsg1+~cs20.10.9.5-2

5.22.1+dfsg1+~cs20.10.10.2-1

5.26.3+dfsg1+~cs23.10.12-1

5.26.3+dfsg1+~cs23.10.12-2

5.26.3+dfsg1+~cs23.10.12-3

5.28.0+dfsg1+~cs23.11.12.3-1

5.28.0+dfsg1+~cs23.11.12.3-2

5.28.2+dfsg1+~cs23.11.12.3-1

5.28.2+dfsg1+~cs23.11.12.3-2

5.28.2+dfsg1+~cs23.11.12.3-3

5.28.2+dfsg1+~cs23.11.12.3-4

5.28.2+dfsg1+~cs23.11.12.3-5

5.28.2+dfsg1+~cs23.11.12.3-6

5.28.4+dfsg1+~cs23.12.11-1

5.28.4+dfsg1+~cs23.12.11-2

7.*

7.1.0+dfsg1+~cs24.12.10-1

7.2.3+dfsg1+~cs24.12.11-1

7.2.3+dfsg1+~cs24.12.11-2

7.3.0+dfsg1+~cs24.12.11-1

7.3.0+dfsg1+~cs24.12.11-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / node-undici