GitHub Advisoryadvisory · npm

GHSA-q5vx-44v4-gch4 llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

CRITICAL Published 2022-07-15 Modified 2023-07-11 Official page ↗
Aliases
CVE-2022-32214
Ecosystem
npm
Packages
llhttp
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-444
Reviewed
2023-07-11

Affected packages

• npm llhttp: < 6.0.7 → fixed in 6.0.7

Description

The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS).

Related

Alias · CVE (1)

  • CVE-2022-32214 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP… vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References