ALPINE-CVE-2022-35256

See a problem?
Please try reporting it to the source first.
Source
https://security.alpinelinux.org/vuln/CVE-2022-35256
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json
JSON Data
https://api.test.osv.dev/v1/vulns/ALPINE-CVE-2022-35256
Upstream
Published
2022-12-05T22:15:10Z
Modified
2026-08-27T22:17:55Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

References

Affected packages

Alpine:v3.13
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
14.20.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.14
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
14.20.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.15
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.17.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.16
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.17.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.17
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.17.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.18
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.17.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.19
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.17.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.20
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.17.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.21
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.17.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.22
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.17.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.23
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.17.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"
Alpine:v3.24
nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.17.1-r0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2022-35256.json"