The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/nodejs/node",
    "versions": [
      {
        "version": "Fixed in 14.20.1+, 16.17.1+,18.9.1+",
        "status": "affected"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf

hackerone.com/reports/1501679

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ICG6CSIB3GUWH5DUSQEVX53MOJW7LYK/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCNN3YG2BCLS4ZEKJ3CLSUT6AS7AXTH3/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/

nodejs.org/en/blog/vulnerability/july-2022-security-releases/

www.debian.org/security/2023/dsa-5326

hackerone 3

nessus 39

cbl_mariner 2

redhatcve 1

debiancve 1

osv 9

f5 1

ibm 21

veracode 1

alpinelinux 1

ubuntucve 1

prion 1

nvd 1

cve 1

suse 7

openvas 27

photon 2

redhat 5

oraclelinux 3

fedora 3

almalinux 2

rocky 3

ubuntu 1

mageia 1

debian 1

nodejsblog 2

freebsd 1

ics 1

gentoo 1

oracle 3

hackerone

Internet Bug Bounty: CVE-2022-32215 - HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding

2022-07-08 03:41:04

Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding

2022-03-06 03:45:24

Node.js: HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (improper fix for CVE-2022-32215)

2022-08-10 08:50:02

nessus

CBL Mariner 2.0 Security Update: nodejs (CVE-2022-32215)

2023-03-20 00:00:00

SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2022:2551-1)

2022-07-27 00:00:00

SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2022:2416-1)

2022-07-22 00:00:00

cbl_mariner

CVE-2022-32215 affecting package nodejs 14.18.3-1

2022-08-12 16:45:11

CVE-2022-32215 affecting package nodejs for versions less than 16.16.0-1

2022-08-31 06:17:55

redhatcve

CVE-2022-32215

2022-07-08 19:17:45

debiancve

CVE-2022-32215

2022-07-14 15:15:08

osv

CVE-2022-32215

2022-07-14 15:15:08

BIT-node-2022-32215

2024-03-06 11:03:48

Moderate: nodejs:14 security and bug fix update

2022-09-13 07:36:51

NodeJS vulnerability CVE-2022-32215

2022-11-22 17:02:00

ibm

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to HTTP request smuggling due to CVE-2022-32215

2022-11-04 18:21:02

Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation

2022-10-21 17:31:42

Security Bulletin: IBM DataPower Gateway potentially vulnerable to HTTP request smuggling

2022-11-21 21:55:18

veracode

HTTP Request Smuggling

2022-07-08 07:05:28

alpinelinux

CVE-2022-32215

2022-07-14 15:15:08

ubuntucve

CVE-2022-32215

2022-07-14 00:00:00

prion

Design/Logic Flaw

2022-07-14 15:15:00

nvd

CVE-2022-32215

2022-07-14 15:15:08

cve

CVE-2022-32215

2022-07-14 15:15:08

suse

Security update for nodejs16 (important)

2022-07-26 00:00:00

Security update for nodejs14 (important)

2022-07-18 00:00:00

Security update for nodejs12 (important)

2022-07-18 00:00:00

openvas

SUSE: Security Advisory (SUSE-SU-2022:2416-1)

2022-07-18 00:00:00

SUSE: Security Advisory (SUSE-SU-2022:2425-1)

2022-07-19 00:00:00

openSUSE: Security Advisory for nodejs16 (SUSE-SU-2022:2551-1)

2022-07-27 00:00:00

photon

Critical Photon OS Security Update - PHSA-2022-0426

2022-07-26 00:00:00

Important Photon OS Security Update - PHSA-2022-3.0-0426

2022-07-26 00:00:00

redhat

(RHSA-2022:6985) Moderate: nodejs:14 security and bug fix update

2022-10-18 07:45:13

(RHSA-2022:6448) Moderate: nodejs:14 security and bug fix update

2022-09-13 07:36:51

(RHSA-2022:6389) Moderate: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security and bug fix update

2022-09-08 07:08:33

oraclelinux

nodejs:14 security and bug fix update

2022-09-15 00:00:00

nodejs:16 security and bug fix update

2022-09-15 00:00:00

nodejs and nodejs-nodemon security and bug fix update

2022-09-22 00:00:00

fedora

[SECURITY] Fedora 37 Update: nodejs-18.12.1-1.fc37

2022-11-29 01:13:36

[SECURITY] Fedora 36 Update: nodejs-16.18.1-1.fc36

2022-11-29 01:28:04

[SECURITY] Fedora 35 Update: nodejs-16.18.1-1.fc35

2022-11-29 00:57:02

almalinux

Moderate: nodejs:14 security and bug fix update

2022-09-13 00:00:00

Moderate: nodejs and nodejs-nodemon security and bug fix update

2022-09-20 00:00:00

rocky

nodejs:14 security and bug fix update

2022-09-13 07:36:51

nodejs:16 security and bug fix update

2022-09-13 07:36:52

nodejs and nodejs-nodemon security and bug fix update

2022-09-20 11:37:49

ubuntu

Node.js vulnerabilities

2023-11-21 00:00:00

mageia

Updated nodejs packages fix security vulnerability

2022-08-26 00:21:07

debian

[SECURITY] [DSA 5326-1] nodejs security update

2023-01-24 20:01:20

nodejsblog

September 23rd 2022 Security Releases

2022-09-15 00:00:00

July 7th 2022 Security Releases

2022-07-07 00:00:00

freebsd

Node.js -- July 7th 2022 Security Releases

2022-07-05 00:00:00

ics

Siemens SINEC INS

2023-01-17 12:00:00

gentoo

Node.js: Multiple Vulnerabilities

2024-05-08 00:00:00

oracle

Oracle Critical Patch Update Advisory - January 2023

2023-01-17 00:00:00

Oracle Critical Patch Update Advisory - October 2022

2022-10-18 00:00:00

Oracle Critical Patch Update Advisory - April 2023

2023-04-18 00:00:00

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

7.4 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.7%

JSON

Related for CVELIST:CVE-2022-32215