CVE-2025-23167 PoC — Node.js 安全漏洞

Source

https://github.com/abhisek3122/CVE-2025-23167

Associated Vulnerability

Title: Node.js 安全漏洞 (CVE-2025-23167)
Description:A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

Description

Working exploit for CVE-2025-23167 – HTTP request smuggling in vulnerable Node.js 20.x versions before 20.19.2

Readme

# CVE-2025-23167 – Node.js HTTP Request Smuggling Exploit

Working exploit for CVE-2025-23167, a request smuggling vulnerability affecting Node.js 20.x versions prior to v20.19.2. This bug allows improper HTTP header termination, enabling attackers to bypass proxy-based access controls.

## Files
- exploit.py – Python3-based Exploit for the vulnerability.
- lab.js – Simple Node.js server to simulate a vulnerable environment.

## Usage

### Exploit
To run the exploit script:
- Run, `python3 exploit.py <target-domain-or-ip> <port>`

### Sample Input & Output
![Sample Input & Output](./sample.png)

### Lab Setup
To set up the test environment:
- Make sure you're using Node.js v20.19.1 or below.
- Install express (`npm install express`).
- Then run, `node lab.js` to run the server.
- The server will be available at http://localhost:8989 (or your chosen port).

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →