Inconsistent interpretation of HTTP requests in Node.js - CVE-2025-23167

Vulnerability identifier: #VU109242

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2025-23167

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/1 headers in llhttp. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Node.js
Arch Linux
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Anolis OS
Web and Scripting Module
openSUSE Leap
Fedora
Netcool Operations Insight
Tenable Identity Exposure (formerly Tenable.ad)
EasyApache
IBM Business Automation Workflow
IBM Documentation Offline
nodejs-nodemon
npm
nodejs-lts-iron
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-docs
nodejs20
corepack20
nodejs20-devel
nodejs20-debugsource
npm20
nodejs20-docs
nodejs20-debuginfo
nodejs-packaging-bundler
nodejs-packaging

Install updates from vendor's website.

Node.js - update to 20.19.2
Netcool Operations Insight - update to 1.6.15
Tenable Identity Exposure (formerly Tenable.ad) - update to 3.77.12
EasyApache - update to 4 25-16
IBM Documentation Offline - update to 1.2.0
nodejs-nodemon - update to 3.0.1-1
npm - update to 10.8.2-1.20.19.2.1
nodejs-lts-iron - update to 20.19.2-1
nodejs - update to 20.19.2-1
nodejs-devel - update to 20.19.2-1
nodejs-full-i18n - update to 20.19.2-1
nodejs-docs - update to 20.19.2-1
nodejs20 - addressed in versions 20.19.2-1.fc41, 20.19.2-1.fc42
corepack20 - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs20-devel - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs20-debugsource - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs20 - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
npm20 - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs20-docs - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs20-debuginfo - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs-packaging-bundler - update to 2021.06-4
nodejs-packaging - update to 2021.06-4

• Exploit #11820 - CVE-2025-23167 (Working exploit for CVE-2025-23167 – HTTP request smuggling in vulnerable Node.js 20.x versions before 20.19.2) (August 1, 2025)

• https://nodejs.org/en/blog/vulnerability/may-2025-security-releases

• Multiple vulnerabilities in Node.js
• Arch Linux update for nodejs-lts-iron
• Fedora 42 update for nodejs20
• Fedora 41 update for nodejs20
• cPanel EasyApache4 update for third-party components
• Anolis OS update for nodejs:20 module
• SUSE update for nodejs20
• SUSE update for nodejs20
• Multiple vulnerabilities in Tenable Identity Exposure
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Documentation Offline