Cyber Resilience

CVE-2023-30589

Nodejs Node.Js 16.0.0 – 16.20.1

Public PoC
Published
01 July 2023
Modified
04 November 2025
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.039 89th percentile
Risk Priority 63 floored blend · peak EPSS

Summary

CVE-2023-30589 is a high-severity an unspecified weakness vulnerability in Nodejs Node.Js. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 11% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header…

more

fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

CWE(s)
NVD-CWE-Other

Related Threats

CVEs Like This One

CVE-2023-32004Same product: Fedoraproject Fedora
CVE-2023-32006Same product: Fedoraproject Fedora
CVE-2023-39332Same product: Fedoraproject Fedora
CVE-2023-32003Same product: Fedoraproject Fedora
CVE-2023-38552Same product: Fedoraproject Fedora
CVE-2023-45143Same product: Fedoraproject Fedora
CVE-2024-30261Same product: Fedoraproject Fedora
CVE-2024-30260Same product: Fedoraproject Fedora
CVE-2025-55132Same product: Nodejs Node.Js
CVE-2026-48928Same product: Nodejs Node.Js

Affected Assets

nodejs
node.js
16.0.0 — 16.20.1 · 18.0.0 — 18.16.1 · 20.0.0 — 20.3.1
fedoraproject
fedora
37, 38

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References