CVE-2025-23167

MEDIUM

Node.js 20 < 20.19.1 - HTTP Request Smuggling via Improper Header Termination

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-23167. PoCs published by abhisek3122.

AI-analyzed exploit summary This repository contains a Python-based exploit for CVE-2025-23167, a Node.js HTTP request smuggling vulnerability. The exploit crafts a malformed HTTP request to test for improper header termination, potentially bypassing proxy-based access controls.

Description

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

Exploits (1)

nomisec WORKING POC
by abhisek3122 · poc
https://github.com/abhisek3122/CVE-2025-23167

This repository contains a Python-based exploit for CVE-2025-23167, a Node.js HTTP request smuggling vulnerability. The exploit crafts a malformed HTTP request to test for improper header termination, potentially bypassing proxy-based access controls.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: Node.js 20.x versions prior to v20.19.2
No auth needed
Prerequisites: Vulnerable Node.js version (20.x < 20.19.2) · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0044
EPSS Percentile 35.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-444
Status published
Products (17)
nodejs/node 10.0 - 10.*
nodejs/node 11.0 - 11.*
nodejs/node 12.0 - 12.*
nodejs/node 13.0 - 13.*
nodejs/node 14.0 - 14.*
nodejs/node 15.0 - 15.*
nodejs/node 16.0 - 16.*
nodejs/node 17.0 - 17.*
nodejs/node 18.0 - 18.*
nodejs/node 19.0 - 19.*
... and 7 more
Published May 19, 2025
Tracked Since Feb 18, 2026