First published: Fri Jul 08 2022(Updated: )
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
Credit: support@hackerone.com support@hackerone.com
Affected Software | Affected Version | How to fix |
---|---|---|
Llhttp Llhttp | <2.1.5 | |
Llhttp Llhttp | >=6.0.0<6.0.7 | |
Nodejs Node.js | >=14.0.0<=14.14.0 | |
Nodejs Node.js | >=14.15.0<14.20.0 | |
Nodejs Node.js | >=16.0.0<=16.12.0 | |
Nodejs Node.js | >=16.13.0<16.16.0 | |
Nodejs Node.js | >=18.0.0<18.5.0 | |
Debian Debian Linux | =11.0 | |
Stormshield Stormshield Management Center | <3.3.0 | |
redhat/nodejs | <14.20.0 | 14.20.0 |
redhat/nodejs | <16.20.0 | 16.20.0 |
redhat/nodejs | <18.5.0 | 18.5.0 |
redhat/nodejs | <1:16.16.0-1.el9_0 | 1:16.16.0-1.el9_0 |
redhat/rh-nodejs14-nodejs | <0:14.20.0-2.el7 | 0:14.20.0-2.el7 |
debian/nodejs | 10.24.0~dfsg-1~deb10u1 10.24.0~dfsg-1~deb10u3 12.22.12~dfsg-1~deb11u4 18.13.0+dfsg1-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
CVE-2022-32214 is a vulnerability found in Node.js due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests.
The severity of CVE-2022-32214 is medium (6.5).
CVE-2022-32214 can lead to HTTP Request Smuggling (HRS) as it allows an attacker to send a specially crafted HTTP request to the server and smuggle arbitrary data.
Node.js versions <v14.20.1, <v16.17.1, and <v18.9.1 are affected by CVE-2022-32214.
To mitigate CVE-2022-32214, update Node.js to versions 14.20.1, 16.17.1, or 18.9.1 or later.