The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-full-i18n | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade v8-develUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-debugsource | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-nodemon | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade node14Upgrade node16Upgrade node | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-17-nodejsUpgrade nodejs-develUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-11-native-imageUpgrade nodejs-docsUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-11Upgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-rubyUpgrade nodejs-libsUpgrade npmUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-11-jdkUpgrade nodejsUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-11-develUpgrade nodejs-packagingUpgrade graalvm22-ce-17-llvm-toolchainUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-17-ruby-develUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-11-llvm-toolchain | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-debugsource | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-debuginfo | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade npm16Upgrade npm14Upgrade nodejs10Upgrade corepack14Upgrade nodejs12-docsUpgrade nodejs14Upgrade corepack18Upgrade nodejs16-docsUpgrade nodejs14-develUpgrade nodejs10-develUpgrade nodejs18-develUpgrade nodejs12-develUpgrade npm12Upgrade nodejs16Upgrade nodejs18-docsUpgrade npm10Upgrade nodejs14-docsUpgrade nodejs12Upgrade nodejs10-docsUpgrade nodejs18Upgrade corepack16Upgrade npm18Upgrade nodejs16-devel | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejsUpgrade libnode-devUpgrade nodejs (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade libnode64Upgrade nodejs-docUpgrade libnode72 | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub