CVE-2025-53094 ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cpp
Attackers can inject CRLF characters into HTTP headers to manipulate responses, affecting ESPAsyncWebServer users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-53094?
CVE-2025-53094 is a high-severity vulnerability in ESP32Async ESPAsyncWebServer, published on 27 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Carriage Return Line Feed) injection vulnerability exists in the construction and output of HTTP headers within `AsyncWebHeader.cpp`. Unsanitized input allows attackers to inject CR (`\r`) or LF (`\n`) characters into header names or values, leading to arbitrary header or response manipulation. Manipulation of HTTP headers and responses can enable a wide range of attacks, making the severity of this vulnerability high. A fix is available at pull request 211 and is expected to be part of version 3.7.9.
Which versions are affected by CVE-2025-53094?
How do I fix CVE-2025-53094?
No fix has been published for CVE-2025-53094 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-53094 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53094 exists.
Sources
Also known as GHSA-87j8-6f7g-h8wh.