PT-2022-21155 · Node.Js+8 · Node.Js+8

Zeyu Zhang + 1 · Publicado 2022-07-08 · Atualizado 2026-05-18 · CVE-2022-32215

Positive Technologies (AI Summary) · Pt

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nome do software vulnerável e versões afetadas

Versões do Node.js anteriores à 14.20.1

Versões do Node.js anteriores à 16.17.1

Versões do Node.js anteriores à 18.9.1

Descrição

O problema decorre do fato de o analisador llhttp no módulo http do Node.js não processar corretamente cabeçalhos Transfer-Encoding com várias linhas, levando ao HTTP Request Smuggling (HRS).

Recomendações

Para versões anteriores à 14.20.1, atualize para a versão 14.20.1 ou posterior.

Para versões anteriores à 16.17.1, atualize para a versão 16.17.1 ou posterior.

Para versões anteriores à 18.9.1, atualize para a versão 18.9.1 ou posterior.

Exploit

Correção

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

ALSA-2022:6448

ALSA-2022:6595

ALT-PU-2022-2226

ALT-PU-2022-3073

ALT-PU-2022-3235

AZL-10153

AZL-41446

BIT-NODE-2022-32215

BIT-NODE-MIN-2022-32215

CESA-2022_6448

CESA-2022_6449

CLEANSTART-2026-BD71263

CLEANSTART-2026-IS74202

CLEANSTART-2026-JR35772

CLEANSTART-2026-JY06700

CLEANSTART-2026-KN34553

CLEANSTART-2026-KZ45320

CLEANSTART-2026-LJ44720

CLEANSTART-2026-LN12820

CLEANSTART-2026-TX00223

CLEANSTART-2026-WI75198

CVE-2022-32215

DSA-5326-1

MGASA-2022-0294

OESA-2023-1551

OPENSUSE-SU-2022_2425-1

OPENSUSE-SU-2022_2430-1

OPENSUSE-SU-2022_2491-1

OPENSUSE-SU-2022_2551-1

OPENSUSE-SU-2022_2855-1

OPENSUSE-SU-2022_3615-1

OPENSUSE-SU-2022_3656-1

OPENSUSE-SU-2023_0419-1

OPENSUSE-SU-2024:12370-1

OPENSUSE-SU-2024:12376-1

RHSA-2022:6389

RHSA-2022:6448

RHSA-2022:6449

RHSA-2022:6595

RHSA-2022:6985

RHSA-2022_6448

RHSA-2022_6449

RHSA-2022_6595

RLSA-2022:6448

RLSA-2022:6449

RLSA-2022:6595

SUSE-SU-2022:2415-1

SUSE-SU-2022:2416-1

SUSE-SU-2022:2417-1

SUSE-SU-2022:2425-1

SUSE-SU-2022:2430-1

SUSE-SU-2022:2491-1

SUSE-SU-2022:2551-1

SUSE-SU-2022:2855-1

SUSE-SU-2022:3524-1

SUSE-SU-2022:3615-1

SUSE-SU-2022:3656-1

SUSE-SU-2023:0408-1

SUSE-SU-2023:0419-1

USN-6491-1

Produtos afetados

Alt Linux

Almalinux

Centos

Linuxmint

Node.Js

Red Hat

Rocky Linux

Suse

Ubuntu

Referências · 298

• 🔥 https://hackerone.com/reports/1501679 · Exploit
• https://github.com/nodejs/node/releases/tag/v14.19.1 · Nota
• https://github.com/nodejs/node/releases/tag/v14.20.0 · Nota
• https://github.com/nodejs/node/releases/tag/v14.19.0 · Nota
• https://github.com/nodejs/node/releases/tag/v14.19.3 · Nota
• https://github.com/nodejs/node/releases/tag/v14.19.2 · Nota
• https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd · Nota
• https://github.com/nodejs/node/commit/d9b71f4c241fa31cc2a48331a4fc28c15937875a · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JY06700 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LJ44720.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KN34553 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WI75198 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KN34553.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KZ45320.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JR35772.json · Nota