CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

Score

CVSS 3.1 6.5 Medium

Status

Modified - support@hackerone.com

Published

2022-12-05

Last modified

2025-04-30

Weaknesses

CWE-444

Affected products

• Debian Linux (Debian)
• Llhttp (Llhttp)
• Node (Nodejs)
• Node.js (Nodejs)
• Sinec Ins (Siemens)

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
• https://hackerone.com/reports/1675191
• https://www.debian.org/security/2023/dsa-5326