Vulnerability in Nodejs Node
CVE-2022-32213
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
Vulnerability class: HTTP Request Smuggling
EPSS: 0.863 (99.4th percentile) — read the EPSS interpretation.
Affected products
- Nodejs Node — versions 4.0, 5.0, 6.0
Weakness classification (CWE)
References
- nodejs.org/en/blog/vulnerability/july-2022-security-releases/
- hackerone.com/reports/1524555
- FEDORA-2022-52dec6351a (vendor-advisory)
- FEDORA-2022-1667f7b60a (vendor-advisory)
- FEDORA-2022-de515f765f (vendor-advisory)
- cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
- DSA-5326 (vendor-advisory)