Lucene search

[email protected]CVE-2022-32213

HistoryJul 14, 2022 - 3:15 p.m.

CVE-2022-32213

2022-07-1415:15:08

CWE-444

[email protected]

web.nvd.nist.gov

148

llhttp

node.js

http request smuggling

hrs

cve-2022-32213

security vulnerability

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

7.2 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.5%

JSON

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Affected configurations

NVD

Node

llhttpllhttpRange<2.1.5node.js

llhttpllhttpRange6.0.0–6.0.7node.js

nodejsnode.jsRange14.0.0–14.14.0-

nodejsnode.jsRange14.15.0–14.20.1lts

nodejsnode.jsRange16.0.0–16.12.0-

nodejsnode.jsRange16.13.0–16.17.1lts

nodejsnode.jsRange18.0.0–18.9.1-

Node

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

fedoraprojectfedoraMatch37

Node

siemenssinec_insMatch1.0-

siemenssinec_insMatch1.0sp1

siemenssinec_insMatch1.0sp2

Node

debiandebian_linuxMatch11.0

Node

stormshieldstormshield_management_centerRange<3.3.2

CPENameOperatorVersion
llhttp:llhttpllhttplt2.1.5
llhttp:llhttpllhttplt6.0.7
nodejs:node.jsnodejs node.jsle14.14.0
nodejs:node.jsnodejs node.jslt14.20.1
nodejs:node.jsnodejs node.jsle16.12.0
nodejs:node.jsnodejs node.jslt16.17.1
nodejs:node.jsnodejs node.jslt18.9.1

CPE	Name	Operator	Version
llhttp:llhttp	llhttp	lt	2.1.5
llhttp:llhttp	llhttp	lt	6.0.7
nodejs:node.js	nodejs node.js	le	14.14.0
nodejs:node.js	nodejs node.js	lt	14.20.1
nodejs:node.js	nodejs node.js	le	16.12.0
nodejs:node.js	nodejs node.js	lt	16.17.1
nodejs:node.js	nodejs node.js	lt	18.9.1

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/nodejs/node",
    "versions": [
      {
        "version": "Fixed in 14.20.1+, 16.17.1+,18.9.1+",
        "status": "affected"
      }
    ]
  }
]