Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields

🗓️ 20 Aug 2022 03:13:30Reported by vvx7Type

hackerone

hackerone🔗 hackerone.com👁 48 Views

Node.js HTTP Request Smuggling in llhttp parse

Reporter	Title	Published	Views	Family All 256
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to Node.js (CVE-2022-43548 & CVE-2022-35256)	6 Jan 202314:37	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Event Streams (CVE-2022-35255 and CVE-2022-35256)	28 Oct 202215:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway vulnerable to HTTP request smuggling (CVE-2022-35256)	16 Dec 202219:00	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability is addressed with IBM Cloud Pak for Business Automation iFixes for November 2022	26 Mar 202502:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in node.js	27 Oct 202210:20	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities.	15 Dec 202209:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	5 Dec 202219:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.8 and earlier	27 Oct 202215:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in node.js	21 Oct 202220:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	5 May 202316:01	–	ibm

26 Oct 2022 08:17Current

8High risk

Vulners AI Score8

EPSS0.03694

node.js http request smuggling llhttp parser incorrect parsing header fields transfer-encoding hrs access control bypass bugbounty