CVE-2022-32213 is a medium-severity HTTP Request Smuggling (HRS) vulnerability affecting the llhttp parser in Node.js versions prior to 14.20.1, 16.17.1, and 18.9.1, as well as various distributions including Debian and Fedora. The flaw stems from improper parsing and validation of Transfer-Encoding headers, allowing an unauthenticated attacker to manipulate HTTP requests. While the CVSS score is 6.5 (Medium), its high EPSS score of 0.89626 and FAUCET Risk Score of 98/100 indicate a significant likelihood of exploitation. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 14.0, < 14.20.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 16.0, < 16.17.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 18.0, < 18.9.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
< 2.1.5CPE matchmatch criteria | cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:* | ||
>= 6.0.0, < 6.0.7CPE matchmatch criteria | cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding
Jul 15, 2022The llhttp parser <v14.20.1 <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
Jul 12, 2022nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding
Jul 8, 2022