boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-30589

CVE-2023-30589HIGH
NodeJS Node — The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests.
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  H  N    7.5   .0391   90.2     —
AFFECTED
  Product  Versions  Fixed
  Node     4.0 –     —
TIMELINE
  Apr 13  Reserved by hackerone
  Jun 30  Published (CNA: hackerone)
  Oct 8   ENRICHED — CVE-2023-30589 (NodeJS Node). Received CVSS 7.5 and CPE data from NVD.
  Oct 8   EXPLOIT PUBLISHED — CVE-2023-30589 (NodeJS Node). Public exploit reference added.
CNA: hackerone · CVSS v3.1 · 10 references · NVD status: Modified

Description

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Lifecycle

Complete event history — 4 events, chronological
DateEventDetail
April 13, 2023ReservedReserved by hackerone
June 30, 2023PublishedPublished (CNA: hackerone)
October 8, 2026ENRICHEDENRICHED — CVE-2023-30589 (NodeJS Node). Received CVSS 7.5 and CPE data from NVD.
October 8, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2023-30589 (NodeJS Node). Public exploit reference added.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
NodeJSNode—4.0—

References (10)

Related

Authoritative record: CVE-2023-30589 at cve.org

Vendors: nodejs

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-30589 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.