The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-nodejsalma-upgrade-nodejs-develalma-upgrade-nodejs-docsalma-upgrade-nodejs-full-i18nalma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packagingalma-upgrade-npm | May 4, 2022 | Nov 3, 2021 | |
| Alpine Linux | alpine-linux-upgrade-nodejsalpine-linux-upgrade-nodejs-current | Mar 26, 2024 | Nov 3, 2021 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-nodejsamazon-linux-2023-upgrade-nodejs-debuginfoamazon-linux-2023-upgrade-nodejs-debugsourceamazon-linux-2023-upgrade-nodejs-develamazon-linux-2023-upgrade-nodejs-docsamazon-linux-2023-upgrade-nodejs-full-i18namazon-linux-2023-upgrade-nodejs-libsamazon-linux-2023-upgrade-nodejs-libs-debuginfoamazon-linux-2023-upgrade-npmamazon-linux-2023-upgrade-v8-devel | Feb 17, 2025 | Oct 12, 2021 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Nov 3, 2021 | |
| Centos_linux | — | centos-upgrade-nodejscentos-upgrade-nodejs-debuginfocentos-upgrade-nodejs-debugsourcecentos-upgrade-nodejs-develcentos-upgrade-nodejs-docscentos-upgrade-nodejs-full-i18ncentos-upgrade-nodejs-nodemoncentos-upgrade-nodejs-packagingcentos-upgrade-npm | Dec 17, 2021 | Nov 3, 2021 |
| Debian | debian-upgrade-nodejs | Nov 4, 2022 | Nov 3, 2021 | |
| Freebsd | freebsd-upgrade-package-nodefreebsd-upgrade-package-node14 | Nov 4, 2022 | Oct 14, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-net-libs-nodejs | May 10, 2024 | Nov 3, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-runtime-nodejs-16-11-1-11-4-39-0-1-107-2oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-12-12-22-7-11-4-39-0-1-107-2oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-14-14-18-1-11-4-39-0-1-107-2oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-16-16-11-1-11-4-39-0-1-107-2 | Nov 17, 2021 | Nov 17, 2021 | |
| Oracle_linux | — | oracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-npm | Dec 17, 2021 | Oct 12, 2021 |
| Redhat_linux | redhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-npm | Dec 17, 2021 | Nov 3, 2021 | |
| Rocky_linux | rocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-npm | Mar 5, 2024 | Nov 3, 2021 | |
| Suse | — | suse-upgrade-nodejs10suse-upgrade-nodejs10-develsuse-upgrade-nodejs10-docssuse-upgrade-nodejs12suse-upgrade-nodejs12-develsuse-upgrade-nodejs12-docssuse-upgrade-nodejs14suse-upgrade-nodejs14-develsuse-upgrade-nodejs14-docssuse-upgrade-npm10suse-upgrade-npm12suse-upgrade-npm14 | Dec 7, 2021 | Nov 3, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub