CVE-2022-32214CWE-444

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests

published July 14, 2022

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.

CVSS
—
EPSS
82%
Percentile
99.6
In the wild
Unconfirmed
What it is

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.81832 · 99.6th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2022-07-14T00:00Z
EPSS history
Timeline
  • 14 JUL 00:00Z
    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests
    cvelistv5