PT-2025-21254 · Debian+7 · Debian+8

Kenballus · Published 2025-01-01 · Updated 2025-10-06 · CVE-2025-23167

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to the llhttp v9 upgrade node-undici in Debian Linux (affected versions not specified)

Description: A flaw in the HTTP parser of Node.js allows improper termination of HTTP/1 headers using r rX instead of the required r r . This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

Recommendations: For Node.js versions prior to the llhttp v9 upgrade, upgrade llhttp to version 9 to enforce correct header termination. For node-undici in Debian Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

AZL-61914

AZL-65063

BDU:2025-10618

BIT-NODE-2025-23167

BIT-NODE-MIN-2025-23167

CESA-2025_8514

CVE-2025-23167

ECHO-5136-5B45-28CC

INFSA-2025_8468

MGASA-2025-0161

RHSA-2025:8468

RHSA-2025:8514

RHSA-2025_8468

RHSA-2025_8514

SUSE-SU-2025:02039-1

SUSE-SU-2025:02045-1

SUSE-SU-2025_02039-1

SUSE-SU-2025_02045-1

Affected Products

Centos

Debian

Node.Js

Red Hat

Red Os

Rocky Linux

Suse

Llhttp

Node-Undici

References · 36

• https://osv.dev/vulnerability/AZL-65063 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-2025-23167 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0161.html · Security Note
• https://bdu.fstec.ru/vul/2025-10618 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-23167 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61914 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-min-2025-23167 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02045-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0161 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23167 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-23167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23167 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2025-23167 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02039-1 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=34278 · Note