CVE-2023-50694 is a critical improper input validation flaw in HttpBeast, the Nim HTTP server behind Jester, in version 0.4.1 and earlier. NVD scores it 9.8. The report describes HTTP request smuggling. No fixed version is confirmed, so run it behind a reverse proxy and track the project.
What's affected
The NVD record names dom96 HttpBeast version 0.4.1 and before. It says insufficient parsing in the parser.nim component lets a remote attacker send a malicious crafted request. The weakness is typed CWE-20 and the record was published on 2024-01-19.
NVD scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The GitHub issue linked from the record reports HTTP/1.1 request smuggling in HttpBeast and Jester, tested against the latest versions in December 2023.
The maintainer closed the issue as completed the same day. He said the library expects to be put behind a reverse proxy that protects against these problems, and that it would need substantial hardening before running directly on the open internet. A pull request, number 96, is linked in the record but was not confirmed here as a fix. No fixed version number appears in any source, so the advisory position is a deployment recommendation, not a patch.
How to check if you're exposed
Look at your Nimble dependencies for httpbeast and note the version:
nimble list -i
Version 0.4.1 or below matches the record. HttpBeast is often pulled in by Jester, so a project can use it without naming it. Check the lock file or the output above, not only your own requires line.
Then look at the deployment. If clients reach the service directly, it is in the situation the report describes. If a reverse proxy sits in front, check that it rejects ambiguous message framing instead of passing it through.
What to do now
- Find every project that depends on HttpBeast, directly or through Jester.
- Place a maintained reverse proxy in front of each service and block direct access to its port.
- Make the proxy reject requests with conflicting or duplicated length information.
- Check the HttpBeast repository for a release that addresses pull request 96 and upgrade when one appears.
- Avoid exposing HttpBeast directly to the internet.
Why it matters
The record classifies the issue as improper input validation, CWE-20. A hand written HTTP parser has to handle many edge cases around headers and message length. When it accepts input that other components read differently, an attacker can slip a second request inside the first.
Smuggling matters most in layered setups. A proxy that enforces authentication or filtering can be bypassed if the backend sees a request the proxy never examined. The fix in a layered design is strict, matching parsing on both sides.
The record shows no CISA Known Exploited Vulnerabilities listing, and the fetched pages do not report exploitation in the wild.
Quick check
Does a reverse proxy remove the risk?
It reduces it, as the maintainer advises, provided the proxy rejects ambiguous requests. It is a mitigation, not a code fix.
Where is the fix?
No source confirms a fixed version. The record links pull request 96, which should be checked against the project releases.
Sources
Last reviewed: 19 October 2026.
