Llhttp - vulnerabilities (CVEs)

6 CVEs in 1 products, 0 in the last 30 days, newest from 2022-12-05.

Products

CVE-2022-35256 - CVSS 6.5 (medium), 2022-12-05: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP…
CVE-2022-32213 - CVSS 6.5 (medium), 2022-07-14: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead…
CVE-2022-32215 - CVSS 6.5 (medium), 2022-07-14: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can…
CVE-2022-32214 - CVSS 6.5 (medium), 2022-07-14: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can…
CVE-2021-22959 - CVSS 6.5 (medium), 2021-11-15: The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp <…
CVE-2021-22960 - CVSS 6.5 (medium), 2021-11-03: The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling…