CVE intelligence

CVE-2025-23167

Vulnerability intelligence

Published May 19, 2025Sources checked Nov 12, 2026

6.5MEDIUMCVSS out of 10

What this means

Review the available evidence

CVE-2025-23167 and is rated Medium severity with a CVSS score of 6.5. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Sep 28, 2026

CBL-Mariner Releases Release Notes

CISA KEVNot listedBased on the latest collected catalog

EPSS0.5%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2025-23167?

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.

Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

Source: NVD