CVE-2022-32213

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 44.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-14 · updated 2026-06-17
Weakness: CWE-444

Description

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Affected products

Debian Linux: 11.0
Fedoraproject Fedora: 35, 36, 37
Llhttp: before 2.1.5; from 6.0.0 before 6.0.7 — fixed in 2.1.5, 6.0.7
Node.js: from 14.0.0 through 14.14.0; from 14.15.0 before 14.20.1; from 16.0.0 through 16.12.0; from 16.13.0 before 16.17.1; from 18.0.0 before 18.9.1 — fixed in 14.20.1, 16.17.1, 18.9.1
Siemens SINEC INS: 1.0, 1.0-sp1, 1.0-sp2
Stormshield Management Center: before 3.3.2 — fixed in 3.3.2

How to fix

Upgrade to a fixed version: Llhttp 2.1.5, 6.0.7; Node.js 14.20.1, 16.17.1, 18.9.1; Stormshield Management Center 3.3.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-32213 or the next vulnerability affects your stack