CVE-2022-32214

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-32214
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-32214.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-32214
Aliases
Downstream
ALPINE (1)
ALSA (2)
AZL (2)
BELL (1)
CGA (2)
CLEANSTART (16)
DEBIAN (1)
MGASA (1)
OESA (1)
RHSA (5)
RLSA (3)
SUSE (10)
UBUNTU (1)
Related
ALSA (2)
SUSE (10)
Published
2022-07-14T00:00:00Z
Modified
2026-07-17T21:00:50Z
Summary
[none]
Details

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

Database specific 
{
    "cna_assigner": "hackerone",
    "cwe_ids": [
        "CWE-444"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32214.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "4.*"
                },
                {
                    "introduced": "5.0"
                },
                {
                    "fixed": "5.*"
                },
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "6.*"
                },
                {
                    "introduced": "7.0"
                },
                {
                    "fixed": "7.*"
                },
                {
                    "introduced": "8.0"
                },
                {
                    "fixed": "8.*"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "fixed": "9.*"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "fixed": "10.*"
                },
                {
                    "introduced": "11.0"
                },
                {
                    "fixed": "11.*"
                },
                {
                    "introduced": "12.0"
                },
                {
                    "fixed": "12.*"
                },
                {
                    "introduced": "13.0"
                },
                {
                    "fixed": "13.*"
                },
                {
                    "introduced": "14.0"
                },
                {
                    "fixed": "14.20.0"
                },
                {
                    "introduced": "15.0"
                },
                {
                    "fixed": "15.*"
                },
                {
                    "introduced": "16.0"
                },
                {
                    "fixed": "16.20.0"
                },
                {
                    "introduced": "17.0"
                },
                {
                    "fixed": "17.*"
                },
                {
                    "introduced": "18.0"
                },
                {
                    "fixed": "18.5.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/nodejs/llhttp

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/llhttp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f014c23bffb327f3749c6222e96247aec73a1caf
Introduced
3ec2251f809073fe8abdb50da6e7acb9d96a2ad9
Fixed
315a1c1b7695c2d1c4e80b359a3e30bc7b3f3f22
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.5"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.7"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

release/v1.*
release/v1.1.0
release/v1.1.1
release/v1.1.2
release/v1.1.3
release/v1.1.4
release/v2.*
release/v2.0.0
release/v2.0.1
release/v2.0.2
release/v2.0.3
release/v2.0.4
release/v2.0.5
release/v2.1.0
release/v2.1.1
release/v2.1.3
release/v2.2.0
release/v2.2.1
release/v3.*
release/v3.0.0
release/v3.0.1
release/v4.*
release/v4.0.0
release/v4.1.0
release/v4.1.1
release/v5.*
release/v5.0.0
release/v5.1.0
release/v6.*
release/v6.0.0
release/v6.0.1
release/v6.0.2
release/v6.0.3
release/v6.0.4
release/v6.0.5
release/v6.0.6
release/v6.0.7
v1.*
v1.0.1
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.3
v2.1.4
v6.*
v6.0.7
v6.0.7a

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-32214.json"