Description
Node.js中存在一个HTTP请求走私漏洞，该漏洞是由于传入请求中HTTP头字段的分隔符不当造成的。
Node.js llhttp HTTP请求走私漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.tenablecloud.cn/plugins/nessus/165634
https://avd.aliyun.com/detail?id=AVD-2023-30589
https://github.com/advisories/GHSA-cggh-pq45-6h9x
https://nvd.nist.gov/vuln/detail/cve-2023-30589
https://security.snyk.io/vuln/SNYK-UPSTREAM-NODE-5741793
https://www.sentinelone.com/vulnerability-database/cve-2023-30589/
https://www.herodevs.com/vulnerability-directory/cve-2023-30589
https://access.redhat.com/security/cve/CVE-2023-30589
https://zeropath.com/blog/cve-2022-35256-nodejs-http-request-smuggling
https://nodejs.org/en/blog/vulnerability/september-2022-security-releases
https://cloud.tencent.com/developer/article/2562956
https://hackerone.com/reports/2001873
https://www.venustech.com.cn/new_type/aqtg/20220713/24167.html
https://app.opencve.io/cve/?vendor=llhttp
https://llhttp.org/
https://www.miggo.io/vulnerability-database/cve/CVE-2022-32213