CVE-2021-22959

🗓️ 15 Nov 2021 14:45:16Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 382 Views

The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6

Reporter	Title	Published	Views	Family All 221
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway potentially affected by various vulnerabilities in Node	29 Jul 202218:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	23 Nov 202115:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	17 Dec 202104:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple security vulnerabilities due to its use of NodeJS (CVE-2021-22918, CVE-2021-22960, CVE-2021-22959)	15 Jul 202215:47	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Node.js affects IBM Event Streams (CVE-2021-22959)	4 Jan 202213:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) - CVE-2021-22960, CVE-2021-22959	26 Jan 202208:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Node.js affect IBM Voice Gateway	21 Oct 202117:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in PostgreSQL, Node.js, and Data Tables from Spry Media may affect IBM Spectrum Protect Plus	31 Jan 202218:22	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-22959, CVE-2021-22960)	22 Apr 202220:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to HTTP request smuggling due to CVE-2021-22959	31 Mar 202214:10	–	ibm

NVD

Vulners

Node

llhttp llhttpRange<2.1.4node.js

llhttp llhttpRange3.0.0–6.0.6node.js

Node

oracle graalvmMatch20.3.4enterprise

oracle graalvmMatch21.3.0enterprise

Node

debian debian_linuxMatch11.0

[
  {
    "product": "Node",
    "vendor": "NodeJS",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "4.0",
        "status": "affected",
        "lessThan": "4.*"
      },
      {
        "versionType": "semver",
        "version": "5.0",
        "status": "affected",
        "lessThan": "5.*"
      },
      {
        "versionType": "semver",
        "version": "6.0",
        "status": "affected",
        "lessThan": "6.*"
      },
      {
        "versionType": "semver",
        "version": "7.0",
        "status": "affected",
        "lessThan": "7.*"
      },
      {
        "versionType": "semver",
        "version": "8.0",
        "status": "affected",
        "lessThan": "8.*"
      },
      {
        "versionType": "semver",
        "version": "9.0",
        "status": "affected",
        "lessThan": "9.*"
      },
      {
        "versionType": "semver",
        "version": "10.0",
        "status": "affected",
        "lessThan": "10.*"
      },
      {
        "versionType": "semver",
        "version": "11.0",
        "status": "affected",
        "lessThan": "11.*"
      },
      {
        "versionType": "semver",
        "version": "12.0",
        "status": "affected",
        "lessThan": "12.22.7"
      },
      {
        "versionType": "semver",
        "version": "13.0",
        "status": "affected",
        "lessThan": "13.*"
      },
      {
        "versionType": "semver",
        "version": "14.0",
        "status": "affected",
        "lessThan": "14.18.1"
      },
      {
        "versionType": "semver",
        "version": "15.0",
        "status": "affected",
        "lessThan": "15.*"
      },
      {
        "versionType": "semver",
        "version": "16.0",
        "status": "affected",
        "lessThan": "16.11.1"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/security-alerts/cpujan2022.html
debian	www.debian.org/security/2022/dsa-5170
hackerone	www.hackerone.com/reports/1238709

30 Apr 2025 22:24Current

7.1High risk

Vulners AI Score7.1

CVSS 26.4

CVSS 3.16.5

EPSS0.00164

CWE-444