UBUNTU-CVE-2022-32213
- Source
- https://ubuntu.com/security/CVE-2022-32213
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-32213.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2022-32213
- Upstream
- Downstream
- Related
- Published
- 2022-07-14T15:15:00Z
- Modified
- 2025-09-08T16:50:15Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
- References
-
- https://ubuntu.com/security/CVE-2022-32213
- https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-flawed-parsing-of-transfer-encoding-medium-cve-2022-32213
- https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd
- https://github.com/nodejs/node/commit/d9b71f4c241fa31cc2a48331a4fc28c15937875a
- https://ubuntu.com/security/notices/USN-6491-1
- https://www.cve.org/CVERecord?id=CVE-2022-32213
Affected packages
Ubuntu:22.04:LTS / nodejs
Package
- Name
- nodejs
- Purl
- pkg:deb/ubuntu/nodejs@12.22.9~dfsg-1ubuntu3.2?arch=source&distro=jammy
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed12.22.9~dfsg-1ubuntu3.2
Affected versions
12.*
12.22.5~dfsg-5ubuntu1
12.22.7~dfsg-2ubuntu1
12.22.7~dfsg-2ubuntu3
12.22.9~dfsg-1ubuntu2
12.22.9~dfsg-1ubuntu3
12.22.9~dfsg-1ubuntu3.1
Ecosystem specific
{
"availability": "No subscription required",
"binaries": [
{
"binary_version": "12.22.9~dfsg-1ubuntu3.2",
"binary_name": "libnode-dev"
},
{
"binary_version": "12.22.9~dfsg-1ubuntu3.2",
"binary_name": "libnode72"
},
{
"binary_version": "12.22.9~dfsg-1ubuntu3.2",
"binary_name": "nodejs"
}
]
}