NetSight
IP …
medium6.5

CVE-2022-32215

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers.

Impact

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

Affected products

VendorProductAffected versions
LlhttpLlhttp
from 14.0.0 before 14.20.1
from 16.0.0 before 16.17.1
from 18.0.0 before 18.9.1
NodejsNode.Js
from 14.0.0 through 14.14.0
from 14.15.0 before 14.20.0
from 16.0.0 through 16.12.0
from 16.13.0 before 16.16.0
from 18.0.0 before 18.5.0
FedoraprojectFedora
Versions 35, 36, 37
SiemensSinec Ins
Version 1.0
DebianDebian Linux
Version 11.0
StormshieldStormshield Management Center
before 3.3.2

Weakness classification

CWE-444

References