Threat database

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	–	EPSS 0.5%	CVE-2025-23167Microsoft · A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit HighEPSS 0.5%2025-05-02GCVE DatabaseCVE-2025-23167 CVE-2025-23167 is a vulnerability in Node.js 20's HTTP parser where HTTP/1 headers can be improperly terminated using '\r\n\rX' instead of the required '\r\n\r\n'. This inconsistency enables HTTP request smuggling, potentially allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The vulnerability affects certain Microsoft products including Azure Linux versions 2.0 and 3.0. No CVSS score or patch information is currently available, and there are no known exploits in the wild at this time. EPSS 0.5%Vulnerability Microsoft Security Response Center #microsoft-security-response-ce	GCVE Database	2025-05-02

Page 1 of 1