critical9.1
CVE-2022-32214
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
Impact
The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | llhttp | < 6.0.7 | 6.0.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Llhttp | Llhttp | before 2.1.5 from 6.0.0 before 6.0.7 |
| Nodejs | Node.Js | from 14.0.0 through 14.14.0 from 14.15.0 before 14.20.0 from 16.0.0 through 16.12.0 from 16.13.0 before 16.16.0 from 18.0.0 before 18.5.0 |
| Debian | Debian Linux | Version 11.0 |
| Stormshield | Stormshield Management Center | before 3.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://hackerone.com/reports/1524692
- https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
- https://www.debian.org/security/2023/dsa-5326
- https://github.com/advisories/GHSA-q5vx-44v4-gch4
- https://nvd.nist.gov/vuln/detail/CVE-2022-32214
- https://security.netapp.com/advisory/ntap-20220915-0001/
- https://github.com/nodejs/llhttp/commit/18a4afc7ffb4e49dc9e2daebc50588199a6d1dbb
- https://datatracker.ietf.org/doc/html/rfc7230#section-3