PT-2022-21154 · Node.Js+8 · Node.Js+8
Zeyu Zhang
+1
·
Published
2022-07-08
·
Updated
2026-05-18
·
CVE-2022-32213
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Node.js versions prior to 14.20.1
Node.js versions prior to 16.17.1
Node.js versions prior to 18.9.1
Description
The issue arises from the llhttp parser in the http module in Node.js, which does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). All versions of the nodejs 18.x, 16.x, and 14.x release lines are impacted.
Recommendations
For Node.js versions prior to 14.20.1, update to version 14.20.1 or later.
For Node.js versions prior to 16.17.1, update to version 16.17.1 or later.
For Node.js versions prior to 18.9.1, update to version 18.9.1 or later.
As a temporary workaround, consider restricting access to the
http module until a patch is available.Exploit
Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Node.Js
Red Hat
Rocky Linux
Suse
Ubuntu