The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-nodejsalma-upgrade-nodejs-develalma-upgrade-nodejs-docsalma-upgrade-nodejs-full-i18nalma-upgrade-nodejs-libsalma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packagingalma-upgrade-npm | Oct 11, 2022 | Jul 14, 2022 | |
| Alpine Linux | alpine-linux-upgrade-nodejsalpine-linux-upgrade-nodejs-current | Mar 26, 2024 | Jul 14, 2022 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-nodejsamazon-linux-2023-upgrade-nodejs-debuginfoamazon-linux-2023-upgrade-nodejs-debugsourceamazon-linux-2023-upgrade-nodejs-develamazon-linux-2023-upgrade-nodejs-docsamazon-linux-2023-upgrade-nodejs-full-i18namazon-linux-2023-upgrade-nodejs-libsamazon-linux-2023-upgrade-nodejs-libs-debuginfoamazon-linux-2023-upgrade-npmamazon-linux-2023-upgrade-v8-devel | Feb 17, 2025 | Jul 8, 2022 | |
| Centos_linux | — | centos-upgrade-nodejscentos-upgrade-nodejs-debuginfocentos-upgrade-nodejs-debugsourcecentos-upgrade-nodejs-develcentos-upgrade-nodejs-docscentos-upgrade-nodejs-full-i18ncentos-upgrade-nodejs-libscentos-upgrade-nodejs-libs-debuginfocentos-upgrade-nodejs-nodemoncentos-upgrade-nodejs-packagingcentos-upgrade-npm | Oct 20, 2022 | Jul 14, 2022 |
| Debian | debian-upgrade-nodejs | Jan 26, 2023 | Jul 14, 2022 | |
| Freebsd | freebsd-upgrade-package-nodefreebsd-upgrade-package-node16freebsd-upgrade-package-node14 | Nov 4, 2022 | Jul 8, 2022 | |
| Gentoo Linux | gentoo-linux-upgrade-net-libs-nodejs | May 10, 2024 | Jul 14, 2022 | |
| Oracle_linux | — | oracle-linux-upgrade-graalvm22-ce-11oracle-linux-upgrade-graalvm22-ce-11-develoracle-linux-upgrade-graalvm22-ce-11-espressooracle-linux-upgrade-graalvm22-ce-11-espresso-llvmoracle-linux-upgrade-graalvm22-ce-11-fastroracle-linux-upgrade-graalvm22-ce-11-javascriptoracle-linux-upgrade-graalvm22-ce-11-jdkoracle-linux-upgrade-graalvm22-ce-11-libpolyglotoracle-linux-upgrade-graalvm22-ce-11-llvmoracle-linux-upgrade-graalvm22-ce-11-llvm-toolchainoracle-linux-upgrade-graalvm22-ce-11-native-imageoracle-linux-upgrade-graalvm22-ce-11-native-image-llvm-backendoracle-linux-upgrade-graalvm22-ce-11-nodejsoracle-linux-upgrade-graalvm22-ce-11-nodejs-develoracle-linux-upgrade-graalvm22-ce-11-polyglotoracle-linux-upgrade-graalvm22-ce-11-pythonoracle-linux-upgrade-graalvm22-ce-11-python-develoracle-linux-upgrade-graalvm22-ce-11-rubyoracle-linux-upgrade-graalvm22-ce-11-ruby-develoracle-linux-upgrade-graalvm22-ce-11-toolsoracle-linux-upgrade-graalvm22-ce-11-wasmoracle-linux-upgrade-graalvm22-ce-17oracle-linux-upgrade-graalvm22-ce-17-develoracle-linux-upgrade-graalvm22-ce-17-espressooracle-linux-upgrade-graalvm22-ce-17-espresso-llvmoracle-linux-upgrade-graalvm22-ce-17-fastroracle-linux-upgrade-graalvm22-ce-17-javascriptoracle-linux-upgrade-graalvm22-ce-17-jdkoracle-linux-upgrade-graalvm22-ce-17-libpolyglotoracle-linux-upgrade-graalvm22-ce-17-llvmoracle-linux-upgrade-graalvm22-ce-17-llvm-toolchainoracle-linux-upgrade-graalvm22-ce-17-native-imageoracle-linux-upgrade-graalvm22-ce-17-native-image-llvm-backendoracle-linux-upgrade-graalvm22-ce-17-nodejsoracle-linux-upgrade-graalvm22-ce-17-nodejs-develoracle-linux-upgrade-graalvm22-ce-17-polyglotoracle-linux-upgrade-graalvm22-ce-17-pythonoracle-linux-upgrade-graalvm22-ce-17-python-develoracle-linux-upgrade-graalvm22-ce-17-rubyoracle-linux-upgrade-graalvm22-ce-17-ruby-develoracle-linux-upgrade-graalvm22-ce-17-toolsoracle-linux-upgrade-graalvm22-ce-17-wasmoracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-libsoracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-npm | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | redhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-libsredhat-upgrade-nodejs-libs-debuginforedhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-npm | Oct 20, 2022 | Jul 14, 2022 | |
| Rocky_linux | rocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-npm | Mar 12, 2024 | Jul 14, 2022 | |
| Suse | — | suse-upgrade-corepack14suse-upgrade-corepack16suse-upgrade-corepack18suse-upgrade-nodejs10suse-upgrade-nodejs10-develsuse-upgrade-nodejs10-docssuse-upgrade-nodejs12suse-upgrade-nodejs12-develsuse-upgrade-nodejs12-docssuse-upgrade-nodejs14suse-upgrade-nodejs14-develsuse-upgrade-nodejs14-docssuse-upgrade-nodejs16suse-upgrade-nodejs16-develsuse-upgrade-nodejs16-docssuse-upgrade-nodejs18suse-upgrade-nodejs18-develsuse-upgrade-nodejs18-docssuse-upgrade-npm10suse-upgrade-npm12suse-upgrade-npm14suse-upgrade-npm16suse-upgrade-npm18 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | ubuntu-pro-upgrade-nodejsubuntu-pro-upgrade-nodejs-devubuntu-pro-upgrade-nodejs-docubuntu-upgrade-libnode-devubuntu-upgrade-libnode64ubuntu-upgrade-libnode72ubuntu-upgrade-nodejsubuntu-upgrade-nodejs-doc | Nov 22, 2023 | Jul 14, 2022 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub