CVE-2022-32214

2022-07-1415:15:08

CWE-444

[email protected]

web.nvd.nist.gov

node.js

http request smuggling

llhttp parser

cve-2022-32214

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.002

Percentile

60.9%

JSON

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

Affected configurations

Nvd

Node

llhttpllhttpRange<2.1.5node.js

llhttpllhttpRange6.0.0–6.0.7node.js

nodejsnode.jsRange14.0.0–14.14.0-

nodejsnode.jsRange14.15.0–14.20.0lts

nodejsnode.jsRange16.0.0–16.12.0-

nodejsnode.jsRange16.13.0–16.16.0lts

nodejsnode.jsRange18.0.0–18.5.0-

Node

debiandebian_linuxMatch11.0

Node

stormshieldstormshield_management_centerRange<3.3.0

VendorProductVersionCPE
llhttpllhttp*cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*
nodejsnode.js*cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
nodejsnode.js*cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
stormshieldstormshield_management_center*cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
llhttp	llhttp	*	cpe:2.3:a:llhttp:llhttp::::::node.js::*
nodejs	node.js	*	cpe:2.3:a:nodejs:node.js:::::-:::*
nodejs	node.js	*	cpe:2.3:a:nodejs:node.js:::::lts:::*
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*
stormshield	stormshield_management_center	*	cpe:2.3:a:stormshield:stormshield_management_center::::::::