CVE-2022-35256

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-35256
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-35256.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-35256
Aliases
Downstream
Related
Published
2022-12-05T00:00:00Z
Modified
2026-06-18T03:56:56.800886856Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

Database specific 
{
    "cna_assigner": "hackerone",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "4.*"
                },
                {
                    "introduced": "5.0"
                },
                {
                    "fixed": "5.*"
                },
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "6.*"
                },
                {
                    "introduced": "7.0"
                },
                {
                    "fixed": "7.*"
                },
                {
                    "introduced": "8.0"
                },
                {
                    "fixed": "8.*"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "fixed": "9.*"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "fixed": "10.*"
                },
                {
                    "introduced": "11.0"
                },
                {
                    "fixed": "11.*"
                },
                {
                    "introduced": "12.0"
                },
                {
                    "fixed": "12.*"
                },
                {
                    "introduced": "13.0"
                },
                {
                    "fixed": "13.*"
                },
                {
                    "introduced": "14.0"
                },
                {
                    "fixed": "14.20.1"
                },
                {
                    "introduced": "15.0"
                },
                {
                    "fixed": "15.*"
                },
                {
                    "introduced": "16.0"
                },
                {
                    "fixed": "16.17.1"
                },
                {
                    "introduced": "17.0"
                },
                {
                    "fixed": "17.*"
                },
                {
                    "introduced": "18.0"
                },
                {
                    "fixed": "18.9.1"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-444"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35256.json"
}
References

Affected packages

Git / github.com/nodejs/llhttp

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/llhttp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
07cf037a904240a3a095d796f6e61ed2f563a8fb
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.0.10"
        }
    ],
    "cpe": "cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*"
}

Affected versions

v1.*
v1.0.1
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.3
v2.2.0
v3.*
v3.0.0
v4.*
v4.0.0
v5.*
v5.0.0
v5.1.0
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.0.8
v6.0.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-35256.json"

Git / github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events
Introduced
73aa21658dfa6a22c06451d080152b32b1f98dbe
Introduced
c1da528bc25c9cc5a8240a7b4f136f5968f6e113
Fixed
c11b8215bd6388854efcc9302a7383c8c63b8127
Introduced
7162e686b18d22b4385fa5c04274fb04dbd810c7
Introduced
40ecd5601193c316e62e9216e8a4259130686208
Fixed
6b06e89c7dfccec6792008302af1cee57649445c
Introduced
49a77a5a996a49e8cb728eed42e55a7c1a9eef6e
Fixed
df3ed1e89299e4c8f006fc20e22265a889c97919
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "14.0.0"
        },
        {
            "last_affected": "14.14.0"
        },
        {
            "introduced": "14.15.0"
        },
        {
            "fixed": "14.20.1"
        },
        {
            "introduced": "16.0.0"
        },
        {
            "last_affected": "16.12.0"
        },
        {
            "introduced": "16.13.0"
        },
        {
            "fixed": "16.17.1"
        },
        {
            "introduced": "18.0.0"
        },
        {
            "fixed": "18.9.1"
        }
    ],
    "cpe": [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"
    ]
}

Affected versions

v14.*
v14.15.0
v14.15.1
v14.15.2
v14.15.3
v14.15.4
v14.15.5
v14.16.0
v14.16.1
v14.17.0
v14.17.1
v14.17.2
v14.17.3
v14.17.4
v14.17.5
v14.17.6
v14.18.0
v14.18.1
v14.18.2
v14.18.3
v14.19.0
v14.19.1
v14.19.2
v14.19.3
v14.20.0
v16.*
v16.13.0
v16.13.1
v16.13.2
v16.14.0
v16.14.1
v16.14.2
v16.15.0
v16.15.1
v16.16.0
v16.17.0
v18.*
v18.0.0
v18.1.0
v18.2.0
v18.3.0
v18.4.0
v18.5.0
v18.6.0
v18.7.0
v18.8.0
v18.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-35256.json"