CVE-2022-32215CWE-444
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers
published July 14, 2022
Patch now
High probability of exploitation
NVD has not assigned a CVSS score to this record. It sits in the 99.4th percentile for exploit probability.
What it is
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.70244 · 99.4th percentile
- Weakness
- CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- Published
- 2022-07-14T00:00Z
EPSS history
Timeline