CVE-2022-32214

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

Score

CVSS 3.1 6.5 Medium

Status

Modified - support@hackerone.com

Published

2022-07-14

Last modified

2025-04-30

Weaknesses

CWE-444

Affected products

• Debian Linux (Debian)
• Llhttp (Llhttp)
• Node (Nodejs)
• Node.js (Nodejs)
• Stormshield Management Center (Stormshield)

References

• https://hackerone.com/reports/1524692
• https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
• https://www.debian.org/security/2023/dsa-5326