The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-libs | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-docsUpgrade v8-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejsUpgrade npm | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-libs-debuginfo | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade nodeUpgrade node14Upgrade node16 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-libsUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-17-llvm-toolchainUpgrade nodejs-packagingUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-11-polyglotUpgrade nodejs-nodemonUpgrade graalvm22-ce-11-develUpgrade graalvm22-ce-17-polyglotUpgrade npmUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-native-image-llvm-backendUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-17-nodejsUpgrade nodejs-develUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-11-llvmUpgrade nodejs-docsUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-11Upgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-17-python | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-full-i18n | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade nodejs10-develUpgrade nodejs18Upgrade npm12Upgrade corepack16Upgrade nodejs16-develUpgrade npm18Upgrade nodejs14-docsUpgrade nodejs18-develUpgrade nodejs18-docsUpgrade nodejs12Upgrade nodejs10-docsUpgrade npm10Upgrade nodejs12-develUpgrade nodejs16Upgrade corepack18Upgrade nodejs14Upgrade nodejs12-docsUpgrade corepack14Upgrade npm16Upgrade npm14Upgrade nodejs14-develUpgrade nodejs16-docsUpgrade nodejs10 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade libnode72Upgrade nodejs-docUpgrade libnode64Upgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejsUpgrade nodejs-dev (Ubuntu Pro) | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub