NetSight
IP …
critical9.1

CVE-2022-32213

llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

Impact

The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Impacts: - All versions of the nodejs 18.x, 16.x, and 14.x releases lines. - llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js

Affected packages

EcosystemPackageAffectedFixed in
npmllhttp< 6.0.76.0.7

Affected products

VendorProductAffected versions
LlhttpLlhttp
before 2.1.5
from 6.0.0 before 6.0.7
NodejsNode.Js
from 14.0.0 through 14.14.0
from 14.15.0 before 14.20.1
from 16.0.0 through 16.12.0
from 16.13.0 before 16.17.1
from 18.0.0 before 18.9.1
FedoraprojectFedora
Versions 35, 36, 37
SiemensSinec Ins
Version 1.0
DebianDebian Linux
Version 11.0
StormshieldStormshield Management Center
before 3.3.2

Weakness classification

CWE-444

References