CVE-2022-32214
published 2022-07-14CVE-2022-32214: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can…
PriorityP353medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
81.46%
99.6th percentile
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | llhttp | < nodejs 18.6.0+dfsg-3 (bookworm) | nodejs 18.6.0+dfsg-3 (bookworm) |
| debian | nodejs | < nodejs 18.6.0+dfsg-3 (bookworm) | nodejs 18.6.0+dfsg-3 (bookworm) |
| llhttp | llhttp | < 2.1.5 | 2.1.5 |
| llhttp | llhttp | >= 0 < 6.0.7 | 6.0.7 |
| llhttp | llhttp | >= 6.0.0 < 6.0.7 | 6.0.7 |
| msrc | azl3_rust_1.75.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.86.0-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_nodejs_16.16.0-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_nodejs_14.20.0-1_on_cbl_mariner_1.0 | — | — |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.20.0 | 14.20.0 |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.20.0 | 16.20.0 |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.5.0 | 18.5.0 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
Detection & IOCsextracted from sources · hover to see the quote
- →HTTP Request Smuggling via non-CRLF header field delimiters — detect HTTP requests where header fields are delimited by characters other than the strict CRLF (\r\n) sequence, which the llhttp parser in Node.js incorrectly accepts ↗
- →Monitor for HTTP Request Smuggling patterns that may result in web cache poisoning or XSS — attacker sends specially crafted HTTP requests smuggling arbitrary HTTP headers ↗
- ·Affected Node.js release lines are 14.x (below v14.20.1), 16.x (below v16.17.1), and 18.x (below v18.9.1); fixed llhttp library versions are v6.0.7 (for Node.js 18.x) and v2.1.5 (for older lines) ↗
- ·Red Hat Enterprise Linux 8 nodejs:18 package is marked Not Affected; verify downstream distribution patch status before assuming exposure ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
osv8.1HIGH
vendor_ubuntu8.1HIGH
vendor_debian6.5LOW
vendor_msrc6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
nodejs vulnerabilities
osv·2023-11-21·CVSS 8.1
CVE-2022-32212 [HIGH] nodejs vulnerabilities
nodejs vulnerabilities
Axel Chong discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-32212)
Zeyu Zhang discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-32213,
CVE-2022-32214, CVE-2022-32215)
It was discovered that Node.js incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly
OSV
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
osv·2022-07-15
CVE-2022-32214 [CRITICAL] llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS).
GHSA
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
ghsa·2022-07-15
CVE-2022-32214 [CRITICAL] CWE-444 llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS).
OSV
CVE-2022-32214: The llhttp parser <v14
osv·2022-07-14·CVSS 6.5
CVE-2022-32214 [MEDIUM] CVE-2022-32214: The llhttp parser <v14
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
Ubuntu
Node.js vulnerabilities
vendor_ubuntu·2023-11-21·CVSS 8.1
CVE-2022-32213 [HIGH] Node.js vulnerabilities
Title: Node.js vulnerabilities
Summary: Several security issues were fixed in Node.js.
Axel Chong discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-32212)
Zeyu Zhang discovered that Node.js incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-32213,
CVE-2022-32214, CVE-2022-32215)
It was discovered that Node.js incorrectly handled certain inputs. If a user
or an automated system were tricked into opening
Microsoft
The llhttp parser <v14.20.1 <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
vendor_msrc·2022-07-12·CVSS 6.5
CVE-2022-32214 [MEDIUM] CWE-444 The llhttp parser <v14.20.1 <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
The llhttp parser Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-lin
Red Hat
nodejs: HTTP request smuggling due to improper delimiting of header fields
vendor_redhat·2022-07-08·CVSS 6.5
CVE-2022-32214 [MEDIUM] CWE-444 nodejs: HTTP request smuggling due to improper delimiting of header fields
nodejs: HTTP request smuggling due to improper delimiting of header fields
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
A vulnerability was found in NodeJS due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests. This issue can lead to HTTP Request Smuggling (HRS). This flaw allows an attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers, causing web cache poisoning, and conducting XSS attacks.
Package: nodejs:18/nodejs (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2022-32214: llhttp - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.j...
vendor_debian·2022·CVSS 6.5
CVE-2022-32214 [MEDIUM] CVE-2022-32214: llhttp - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.j...
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
Scope: local
forky: resolved
sid: resolved
No detection rules found.
No public exploits indexed.
https://hackerone.com/reports/1524692https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/https://www.debian.org/security/2023/dsa-5326https://hackerone.com/reports/1524692https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/https://www.debian.org/security/2023/dsa-5326
2022-07-14
Published