CVE-2021-22959
published 2021-11-15CVE-2021-22959: The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4…
PriorityP433medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
2.94%
85.7th percentile
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | nodejs | < nodejs 12.22.7~dfsg-1 (bookworm) | nodejs 12.22.7~dfsg-1 (bookworm) |
| llhttp | llhttp | < 2.1.4 | 2.1.4 |
| llhttp | llhttp | >= 3.0.0 < 6.0.6 | 6.0.6 |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.22.7 | 12.22.7 |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.18.1 | 14.18.1 |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.11.1 | 16.11.1 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | nodejs | >= 0 < 12.22.12~dfsg-1~deb11u1 | 12.22.12~dfsg-1~deb11u1 |
| nodejs | nodejs | >= 0 < 12.22.7~dfsg-1 | 12.22.7~dfsg-1 |
| nodejs | nodejs | >= 0 < 12.22.7~dfsg-1 | 12.22.7~dfsg-1 |
| nodejs | nodejs | >= 0 < 12.22.7~dfsg-1 | 12.22.7~dfsg-1 |
| oracle | graalvm | — | — |
| oracle | graalvm | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_oracle6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Java SE Risk Matrix: Node (Node.js) — CVE-2021-22959
vendor_oracle·2022-01-15·CVSS 6.5
CVE-2021-22959 [MEDIUM] Oracle Oracle Java SE Risk Matrix: Node (Node.js) — CVE-2021-22959
Oracle Oracle Java SE Risk Matrix: Node (Node.js) vulnerability
CVE: CVE-2021-22959
CVSS: 6.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Red Hat
llhttp: HTTP Request Smuggling due to spaces in headers
vendor_redhat·2021-10-12·CVSS 6.5
CVE-2021-22959 [MEDIUM] CWE-444 llhttp: HTTP Request Smuggling due to spaces in headers
llhttp: HTTP Request Smuggling due to spaces in headers
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
An HTTP Request Smuggling (HRS) vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations are being proxied (such as proxy, reverse-proxy, load-balancer), an attacker can use this flaw to inject arbitrary messages through the proxy. The highest threat from this vulnerability is to confidentiality and integrity.
Statement: Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer por
Debian
CVE-2021-22959: nodejs - The parser in accepts requests with a space (SP) right after the header name bef...
vendor_debian·2021·CVSS 6.5
CVE-2021-22959 [MEDIUM] CVE-2021-22959: nodejs - The parser in accepts requests with a space (SP) right after the header name bef...
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
Scope: local
bookworm: resolved (fixed in 12.22.7~dfsg-1)
bullseye: resolved (fixed in 12.22.12~dfsg-1~deb11u1)
forky: resolved (fixed in 12.22.7~dfsg-1)
sid: resolved (fixed in 12.22.7~dfsg-1)
trixie: resolved (fixed in 12.22.7~dfsg-1)
GHSA
GHSA-mhxq-vjjq-pcvf: The parser in accepts requests with a space (SP) right after the header name before the colon
ghsa_unreviewed·2022-05-24
CVE-2021-22959 [MEDIUM] CWE-444 GHSA-mhxq-vjjq-pcvf: The parser in accepts requests with a space (SP) right after the header name before the colon
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
OSV
CVE-2021-22959: The parser in accepts requests with a space (SP) right after the header name before the colon
osv·2021-11-15·CVSS 6.5
CVE-2021-22959 [MEDIUM] CVE-2021-22959: The parser in accepts requests with a space (SP) right after the header name before the colon
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-11-15
Published