GitHub Advisoryadvisory · npm

GHSA-5689-v88g-g6rv llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

CRITICAL Published 2022-07-15 Modified 2023-07-10 Official page ↗
Aliases
CVE-2022-32213
Ecosystem
npm
Packages
llhttp
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-444
Reviewed
2023-07-10

Affected packages

• npm llhttp: < 6.0.7 → fixed in 6.0.7

Description

The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Impacts: • All versions of the nodejs 18.x, 16.x, and 14.x releases lines. • llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js

Related

Alias · CVE (1)

  • CVE-2022-32213 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding… vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References