CVE-2022-35256 describes an HTTP Request Smuggling vulnerability in the llhttp parser within the Node.js http module, specifically affecting Node v18.7.0 and other products like Debian and Siemens. This medium-severity flaw (CVSS 6.5) arises from improper handling of header fields not terminated with CRLF, potentially leading to information disclosure and integrity issues. While there is no evidence of active exploitation, no public exploit code, and it's not on the KEV catalog, the vulnerability has garnered some community discussion, indicating awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 14.0, < 14.20.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 16.0, < 16.17.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 18.0, < 18.9.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 14.0.0, <= 14.14.0CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 14.15.0, < 14.20.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
Dec 13, 2022nodejs: HTTP Request Smuggling due to incorrect parsing of header fields
Sep 23, 2022