CVE-2022-32214 is an HTTP Request Smuggling (HRS) vulnerability affecting Node.js versions prior to 14.20.1, 16.17.1, and 18.9.1, specifically within the llhttp parser in its http module. The flaw stems from the parser not strictly enforcing CRLF for HTTP request delimitation. This vulnerability carries a CVSS score of 6.5 (MEDIUM) with a low attack complexity and no user interaction required, potentially leading to partial confidentiality and integrity impacts. While its FAUCET Risk Score is high at 96/100, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 14.0, < 14.20.0CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 16.0, < 16.20.0CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 18.0, < 18.5.0CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
< 2.1.5CPE matchmatch criteria | cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:* | ||
>= 6.0.0, < 6.0.7CPE matchmatch criteria | cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
Jul 15, 2022The llhttp parser <v14.20.1 <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
Jul 12, 2022nodejs: HTTP request smuggling due to improper delimiting of header fields
Jul 8, 2022