CVE-2022-32213

Summary

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Affected Software

VendorProductVersion RangeStatus
NodeJSNode4.0 < 4.*affected
NodeJSNode5.0 < 5.*affected
NodeJSNode6.0 < 6.*affected
NodeJSNode7.0 < 7.*affected
NodeJSNode8.0 < 8.*affected
NodeJSNode9.0 < 9.*affected
NodeJSNode10.0 < 10.*affected
NodeJSNode11.0 < 11.*affected
NodeJSNode12.0 < 12.*affected
NodeJSNode13.0 < 13.*affected
NodeJSNode14.0 < 14.20.1affected
NodeJSNode15.0 < 15.*affected
NodeJSNode16.0 < 16.17.1affected
NodeJSNode17.0 < 17.*affected
NodeJSNode18.0 < 18.9.1affected

Weaknesses

  • CWE-444: HTTP Request Smuggling (CWE-444)

ADP Enrichment

CVE Program Container

Additional References

References