CVE-2021-22960

published 2021-11-03

CVE-2021-22960: The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling…

Priority P3 36 medium 6.5 CVSS 3.1

AV N AC L PR N UI N S U C L I L A N

The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.

Affected

23 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	nodejs	< nodejs 12.22.7~dfsg-1 (bookworm)	nodejs 12.22.7~dfsg-1 (bookworm)
llhttp	llhttp	< 2.1.4	2.1.4
llhttp	llhttp	>= 3.0.0 < 6.0.6	6.0.6
nodejs	node	>= 10.0 < 10.*	10.*
nodejs	node	>= 11.0 < 11.*	11.*
nodejs	node	>= 12.0 < 12.22.7	12.22.7
nodejs	node	>= 13.0 < 13.*	13.*
nodejs	node	>= 14.0 < 14.18.1	14.18.1
nodejs	node	>= 15.0 < 15.*	15.*
nodejs	node	>= 16.0 < 16.11.1	16.11.1
nodejs	node	>= 4.0 < 4.*	4.*
nodejs	node	>= 5.0 < 5.*	5.*
nodejs	node	>= 6.0 < 6.*	6.*
nodejs	node	>= 7.0 < 7.*	7.*
nodejs	node	>= 8.0 < 8.*	8.*
nodejs	node	>= 9.0 < 9.*	9.*
nodejs	nodejs	>= 0 < 12.22.12~dfsg-1~deb11u1	12.22.12~dfsg-1~deb11u1
nodejs	nodejs	>= 0 < 12.22.7~dfsg-1	12.22.7~dfsg-1
nodejs	nodejs	>= 0 < 12.22.7~dfsg-1	12.22.7~dfsg-1
nodejs	nodejs	>= 0 < 12.22.7~dfsg-1	12.22.7~dfsg-1
oracle	graalvm	—	—
oracle	graalvm	—	—

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

nvd v2.0 5.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:N

osv 6.5 MEDIUM

vendor_debian 6.5 MEDIUM

vendor_redhat 6.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-444