CVE-2022-32213CWE-444

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead…

published July 14, 2022

CVSS
—
EPSS
46%
Percentile
98.8
In the wild
Unconfirmed
What it is

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.45956 · 98.8th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2022-07-14T00:00Z
EPSS history
Timeline
  • 14 JUL 00:00Z
    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead…
    cvelistv5