Vulnerability CVE-2022-32214: Information

Description

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-32214
Published: July 14, 2022
Modified: July 19, 2023
Error type identifier: CWE-444

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
nodesisyphus16.16.0-alt120.13.1-alt1ALT-PU-2022-2226-1303524Fixed
nodep1014.21.1-alt116.19.1-alt1ALT-PU-2022-3235-1310516Fixed
nodec10f114.21.1-alt116.19.1-alt1ALT-PU-2022-3235-1310516Fixed
nodec9f216.17.1-alt0.c9.116.19.1-alt0.c9.1ALT-PU-2022-3073-1303505Fixed
nodep1116.16.0-alt120.13.1-alt1ALT-PU-2022-2226-1303524Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://hackerone.com/reports/1524692
  • Exploit
  • Issue Tracking
  • Third Party Advisory
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
  • Patch
  • Vendor Advisory
DSA-5326
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*
      End excliding
      2.1.5
      cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*
      Start including
      6.0.0
      End excliding
      6.0.7
      cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
      Start including
      18.0.0
      End excliding
      18.5.0
      cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
      Start including
      14.15.0
      End excliding
      14.20.0
      cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
      Start including
      16.13.0
      End excliding
      16.16.0
      cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
      Start including
      14.0.0
      End including
      14.14.0
      cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
      Start including
      16.0.0
      End including
      16.12.0

      Configuration 2

      cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:*
      End excliding
      3.3.0
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top