Node.js 20 HTTP Header Parsing Flaw Allows Request Smuggling

A vulnerability in Node.js version 20's HTTP parser permits improper termination of HTTP/1 headers. Instead of the required double line break, headers can be incorrectly ended with a single line break followed by a character. This flaw enables request smuggling, allowing attackers to bypass proxy-based access controls and send unauthorized requests. The vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade, which addressed the issue by enforcing correct header termination.

Impact

Exploitation of this vulnerability could lead to request smuggling, allowing unauthorized requests to be sent while bypassing proxy-based access controls.

Remediation

Users can upgrade to Node.js versions 20.19.2, 22.15.1, 23.11.1, or 24.0.2 to address this vulnerability.