The llhttp parser <v14.20.1 <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

🗓️ 22 Jul 2022 07:00:00Reported by MicrosoftType

llhttp parser in Node JavaScript module may not enforce carriage return line feed, enabling request smuggling.

Reporter	Title	Published	Views	Family All 223
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in node.js	8 Aug 202217:42	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of NodeJS, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple security vulnerabilities.	5 Sep 202311:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway potentially vulnerable to HTTP request smuggling	21 Nov 202221:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related Java SE and Node	22 Sep 202207:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for October 2022	28 Oct 202209:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities due to OpenSSL and Node js which affect IBM App Connect Enterprise and IBM Integration Bus	14 Nov 202214:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on IBM Cloud Pak for Data has addressed security vulnerabilities (CVE-2022-32212, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-32222, CVE-2023-26136)	1 Sep 202314:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Answer Retrieval for Watson Discovery is vulnerable to HTTP request smuggling due to NodeJS	12 Jul 202218:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js may affect IBM Spectrum Protect Plus (CVE-2022-32223, CVE-2022-32215, CVE-2022-33987, CVE-2022-32213, CVE-2022-32212, CVE-2022-32222, CVE-2022-32214)	17 Sep 202212:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	5 Dec 202219:00	–	ibm