First published: Fri Jul 08 2022(Updated: )
<a href="https://access.redhat.com/security/cve/CVE-2022-32214">CVE-2022-32214</a> The llhttp parser in the http module does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). More details will be available at <a href="https://access.redhat.com/security/cve/CVE-2022-32214">CVE-2022-32214</a> after publication. Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability. Impacts: All versions of the 18.x, 16.x, and 14.x releases lines. llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js
Credit: support@hackerone.com support@hackerone.com
Affected Software | Affected Version | How to fix |
---|---|---|
Llhttp Llhttp | <2.1.5 | |
Llhttp Llhttp | >=6.0.0<6.0.7 | |
Nodejs Node.js | >=14.0.0<=14.14.0 | |
Nodejs Node.js | >=14.15.0<14.20.0 | |
Nodejs Node.js | >=16.0.0<=16.12.0 | |
Nodejs Node.js | >=16.13.0<16.16.0 | |
Nodejs Node.js | >=18.0.0<18.5.0 | |
Debian Debian Linux | =11.0 | |
Stormshield Stormshield Management Center | <3.3.0 | |
redhat/nodejs | <1:16.16.0-1.el9_0 | 1:16.16.0-1.el9_0 |
redhat/rh-nodejs14-nodejs | <0:14.20.0-2.el7 | 0:14.20.0-2.el7 |
debian/nodejs | 10.24.0~dfsg-1~deb10u1 10.24.0~dfsg-1~deb10u3 12.22.12~dfsg-1~deb11u4 18.13.0+dfsg1-1 | |
redhat/nodejs | <14.20.0 | 14.20.0 |
redhat/nodejs | <16.20.0 | 16.20.0 |
redhat/nodejs | <18.5.0 | 18.5.0 |
IBM Cognos Controller | <=11.0.0 - 11.0.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
CVE-2022-32214 is a vulnerability found in Node.js due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests.
The severity of CVE-2022-32214 is medium (6.5).
CVE-2022-32214 can lead to HTTP Request Smuggling (HRS) as it allows an attacker to send a specially crafted HTTP request to the server and smuggle arbitrary data.
Node.js versions <v14.20.1, <v16.17.1, and <v18.9.1 are affected by CVE-2022-32214.
To mitigate CVE-2022-32214, update Node.js to versions 14.20.1, 16.17.1, or 18.9.1 or later.