Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-32213

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Published

2022-07-14T15:15:08.287

Last Modified

2024-11-21T07:05:56.257

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-444
  • Type: Primary
    CWE-444
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application llhttp llhttp < 2.1.5 Yes
Application llhttp llhttp < 6.0.7 Yes
Application nodejs node.js ≤ 14.14.0 Yes
Application nodejs node.js < 14.20.1 Yes
Application nodejs node.js ≤ 16.12.0 Yes
Application nodejs node.js < 16.17.1 Yes
Application nodejs node.js < 18.9.1 Yes
Operating System fedoraproject fedora 35 Yes
Operating System fedoraproject fedora 36 Yes
Operating System fedoraproject fedora 37 Yes
Application siemens sinec_ins 1.0 Yes
Application siemens sinec_ins 1.0 Yes
Application siemens sinec_ins 1.0 Yes
Operating System debian debian_linux 11.0 Yes
Application stormshield stormshield_management_center < 3.3.2 Yes
References