What’s Vulnerable › Vulnerabilities

CVE-2022-32215

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 70.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-07-14 · updated 2026-06-17
• Weakness: CWE-444

Description

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

Affected products

• Debian Linux: 11.0
• Fedoraproject Fedora: 35, 36, 37
• Llhttp: from 14.0.0 before 14.20.1; from 16.0.0 before 16.17.1; from 18.0.0 before 18.9.1 — fixed in 14.20.1, 16.17.1, 18.9.1
• Node.js: from 14.0.0 through 14.14.0; from 14.15.0 before 14.20.0; from 16.0.0 through 16.12.0; from 16.13.0 before 16.16.0; from 18.0.0 before 18.5.0 — fixed in 14.20.0, 16.16.0, 18.5.0
• Siemens SINEC INS: 1.0, 1.0-sp1, 1.0-sp2
• Stormshield Management Center: before 3.3.2 — fixed in 3.3.2

How to fix

Upgrade to a fixed version: Llhttp 14.20.1, 16.17.1, 18.9.1; Node.js 14.20.0, 16.16.0, 18.5.0; Stormshield Management Center 3.3.2. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
• https://hackerone.com/reports/1501679
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ICG6CSIB3GUWH5DUSQEVX53MOJW7LYK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCNN3YG2BCLS4ZEKJ3CLSUT6AS7AXTH3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/
• https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
• https://www.debian.org/security/2023/dsa-5326
• https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
• https://hackerone.com/reports/1501679
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ICG6CSIB3GUWH5DUSQEVX53MOJW7LYK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCNN3YG2BCLS4ZEKJ3CLSUT6AS7AXTH3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/

Get alerted when CVE-2022-32215 or the next vulnerability affects your stack