What’s Vulnerable › Vulnerabilities

CVE-2022-32214

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 81.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-14 · updated 2026-06-17
• Weakness: CWE-444

Description

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

Affected products

• Debian Linux: 11.0
• Llhttp: before 2.1.5; from 6.0.0 before 6.0.7 — fixed in 2.1.5, 6.0.7
• Node.js: from 14.0.0 through 14.14.0; from 14.15.0 before 14.20.0; from 16.0.0 through 16.12.0; from 16.13.0 before 16.16.0; from 18.0.0 before 18.5.0 — fixed in 14.20.0, 16.16.0, 18.5.0
• Stormshield Management Center: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: Llhttp 2.1.5, 6.0.7; Node.js 14.20.0, 16.16.0, 18.5.0; Stormshield Management Center 3.3.0. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/1524692
• https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
• https://www.debian.org/security/2023/dsa-5326
• https://hackerone.com/reports/1524692
• https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
• https://www.debian.org/security/2023/dsa-5326

Get alerted when CVE-2022-32214 or the next vulnerability affects your stack