CVE-2025-23167

What it actually does

The flaw permits HTTP/1 header sequences terminated with \r\n\rX instead of the required \r\n\r\n, causing the llhttp parser in Node.js 20 to misinterpret request boundaries and enabling request smuggling across front-end proxies.

Why it matters to the business

Attackers can bypass proxy-enforced access controls to reach internal endpoints, potentially exposing sensitive data or performing unauthorized actions on affected Node.js 20 services; prevalence in Ubuntu 24.04 LTS environments increases exposure for organizations running Node.js workloads on those releases.

How an attack unfolds

An attacker sends a crafted HTTP/1 request containing an invalid header terminator (\r\n\rX) to a Node.js 20 backend behind a proxy; the inconsistent parsing allows the attacker to inject a second request that the proxy does not see, bypassing authentication or authorization checks.

How to fix it

Upgrade Node.js 20 installations to a build that includes llhttp version 9 or later; on Ubuntu 24.04 LTS apply the kernel package updates linux 6.8.0-50.51, linux-aws 6.8.0-1020.22, or linux-azure 6.8.0-1020.23 (or newer) that bundle the corrected Node.js runtime.

How to confirm the fix worked

Confirm llhttp version 9 or greater is present in the Node.js binary; re-test header parsing with both compliant (\r\n\r\n) and malformed (\r\n\rX) sequences to verify consistent request boundary handling.

Typical attack path

1. Identify Node.js 20 application reachable via an HTTP proxy or load balancer
2. Craft request with header block terminated by \r\n\rX
3. Smuggle a second request intended for the backend only
4. Bypass proxy rules to reach restricted endpoints or perform privileged actions

How to detect it

Review web server and proxy logs for requests containing non-standard header termination sequences; inspect Node.js process versions and llhttp library versions across the environment.

What your security team should do

• Prioritize patching all Node.js 20 instances to the fixed llhttp 9 build within the next 30 days given the public disclosure date
• Audit proxy configurations for any reliance on Node.js 20 HTTP parsing for access control decisions
• Add monitoring for anomalous request patterns that could indicate smuggling attempts