CVE-2022-35256CWE-444

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF

Medium · published December 5, 2022

CVSS v3.1
6.5
EPSS
3%
Percentile
86.2
In the wild
Unconfirmed
What it is

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02764 · 86.2th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2022-12-05T00:00Z
EPSS history
Timeline
  • 05 DEC 00:00Z
    The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF
    cvelistv5