{"action":"Upgrade llhttp to 8.1.1 or later.","affected":[{"fixed":"8.1.1","introduced":"0"}],"component":"llhttp","cve_ids":["CVE-2023-30589"],"ecosystem":"npm","epss":0.03906,"exploited":false,"fixed_versions":["8.1.1"],"ghsa_id":"GHSA-cggh-pq45-6h9x","id":"tcs_01M5KFJQBMJJFCHKSN2VGYFMME","modified_at":"2026-09-10T03:49:57.269146869Z","published_at":"2023-07-01T00:30:46Z","references":["https://osv.dev/vulnerability/GHSA-cggh-pq45-6h9x","https://nvd.nist.gov/vuln/detail/CVE-2023-30589","https://hackerone.com/reports/2001873","https://github.com/nodejs/llhttp","https://github.com/nodejs/llhttp/releases/tag/release%2Fv8.1.1","https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76","https://security.netapp.com/advisory/ntap-20230803-0009","https://security.netapp.com/advisory/ntap-20240621-0006"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-cggh-pq45-6h9x","url":"https://osv.dev/vulnerability/GHSA-cggh-pq45-6h9x"}],"summary":"llhttp vulnerable to HTTP request smuggling"}