CVE-2022-32213

CRITICAL9.1EPSS 86.3%

llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

發布日:2022/7/15修改日:2026/4/28

描述

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

受影響套件(5)

  • Alpine/nodejsfrom 0, < 14.20.1-r0
  • Bitnami/node>= 14.0.0, < 14.14.1, >= 14.15.0, < 14.20.1, >= 16.0.0, < 16.12.1, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1
  • Bitnami/node-min>= 14.0.0, < 14.14.1, >= 14.15.0, < 14.20.1, >= 16.0.0, < 16.12.1, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1
  • Debian/nodejsfrom 0, < 12.22.12~dfsg-1~deb11u3
  • npm/llhttpfrom 0, < 6.0.7

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1CRITICAL9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

參考連結(16)