CVE & CISA-KEV Catalog

CVE-2025-23167

MEDIUM

6.5

CVSS v3

Description

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

How to fix

Remediation Available

nodejsRocky

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.src::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.src::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

nodejsRed Hat / RHEL

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.src::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.src::nodejs:20RHSA-2025:8468

nodejs-debuginfoRocky

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

nodejs-debuginfoRed Hat / RHEL

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

nodejs-debugsourceRed Hat / RHEL

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

nodejs-debugsourceRocky

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

nodejs-develRed Hat / RHEL

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

nodejs-develRocky

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

nodejs-docsRed Hat / RHEL

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.noarch::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20RHSA-2025:8468

nodejs-docsRocky

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.noarch::nodejs:20RHSA-2025:8514

nodejs-full-i18nRed Hat / RHEL

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

nodejs-full-i18nRocky

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

Fixed in:1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

nodejs-nodemonRocky

Fixed in:0:3.0.1-1.module+el8.10.0+23139+21ba74c5.src::nodejs:20RHSA-2025:8514

Fixed in:0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20RHSA-2025:8468

Fixed in:0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20RHSA-2025:8468

Fixed in:0:3.0.1-1.module+el8.10.0+23139+21ba74c5.noarch::nodejs:20RHSA-2025:8514

nodejs-nodemonRed Hat / RHEL

Fixed in:0:3.0.1-1.module+el9.6.0+23146+be9976bd.src::nodejs:20RHSA-2025:8468

Fixed in:0:3.0.1-1.module+el9.6.0+23146+be9976bd.noarch::nodejs:20RHSA-2025:8468

Fixed in:0:3.0.1-1.module+el8.10.0+23139+21ba74c5.src::nodejs:20RHSA-2025:8514

Fixed in:0:3.0.1-1.module+el8.10.0+23139+21ba74c5.noarch::nodejs:20RHSA-2025:8514

nodejs-packagingRocky

Fixed in:0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20RHSA-2025:8468

Fixed in:0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20RHSA-2025:8468

Fixed in:0:2021.06-4.module+el8.10.0+23139+21ba74c5.noarch::nodejs:20RHSA-2025:8514

Fixed in:0:2021.06-4.module+el8.10.0+23139+21ba74c5.src::nodejs:20RHSA-2025:8514

nodejs-packagingRed Hat / RHEL

Fixed in:0:2021.06-4.module+el8.10.0+23139+21ba74c5.noarch::nodejs:20RHSA-2025:8514

Fixed in:0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20RHSA-2025:8468

Fixed in:0:2021.06-4.module+el8.10.0+23139+21ba74c5.src::nodejs:20RHSA-2025:8514

Fixed in:0:2021.06-4.module+el9.6.0+23146+be9976bd.src::nodejs:20RHSA-2025:8468

nodejs-packaging-bundlerRed Hat / RHEL

Fixed in:0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20RHSA-2025:8468

Fixed in:0:2021.06-4.module+el8.10.0+23139+21ba74c5.noarch::nodejs:20RHSA-2025:8514

nodejs-packaging-bundlerRocky

Fixed in:0:2021.06-4.module+el9.6.0+23146+be9976bd.noarch::nodejs:20RHSA-2025:8468

Fixed in:0:2021.06-4.module+el8.10.0+23139+21ba74c5.noarch::nodejs:20RHSA-2025:8514

npmRocky

Fixed in:1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

Fixed in:1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Fixed in:1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

npmRed Hat / RHEL

Fixed in:1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd.x86_64::nodejs:20RHSA-2025:8468

Fixed in:1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20RHSA-2025:8514

Fixed in:1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20RHSA-2025:8514

Fixed in:1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20RHSA-2025:8468

Fixed in:1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20RHSA-2025:8468

Fixed in:1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20RHSA-2025:8514

Fixed in:1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20RHSA-2025:8468

Fixed in:1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5.x86_64::nodejs:20RHSA-2025:8514

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityLow

IntegrityLow

AvailabilityNone

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploit Intelligence

0.47%probability of exploitation in 30 days

37thpercentile

Low risk: more likely to be exploited than 37% of all known CVEs.

References

Other references1

nodejs.org

Related Vulnerabilities

Other CWE-444 vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2022-22536	Critical	10.0	98%	KEV	-
CVE-2025-61884	High	7.5	98%	KEV + Ransom	-
CVE-2020-9490	High	7.5	90%	-	Fix
CVE-2023-41265	Critical	9.6	85%	KEV + Ransom	-
CVE-2023-25690	Critical	9.8	84%	-	Fix
CVE-2022-32214	Medium	6.5	78%	-	Fix

Embed a live status badge for CVE-2025-23167

Markdown

[![CVE-2025-23167](https://tridentstack.com/cve/badge/CVE-2025-23167.svg)](https://tridentstack.com/cve/CVE-2025-23167)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-23167"><img src="https://tridentstack.com/cve/badge/CVE-2025-23167.svg" alt="CVE-2025-23167"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-05-19.