The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade npm | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-devel | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfo | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade node14Upgrade node16Upgrade node | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-nodejsUpgrade nodejs-develUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-11-pythonUpgrade nodejs-docsUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-11Upgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-17Upgrade nodejs-packagingUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-17-jdkUpgrade nodejsUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-develUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-rubyUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-polyglotUpgrade nodejs-libsUpgrade graalvm22-ce-11-jdkUpgrade npmUpgrade graalvm22-ce-11-javascript | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade npm | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade corepack18Upgrade nodejs14-develUpgrade npm14Upgrade nodejs16-docsUpgrade nodejs12-docsUpgrade nodejs10Upgrade corepack14Upgrade nodejs14Upgrade npm16Upgrade nodejs12Upgrade npm10Upgrade nodejs18-develUpgrade npm18Upgrade nodejs12-develUpgrade npm12Upgrade corepack16Upgrade nodejs18Upgrade nodejs10-docsUpgrade nodejs18-docsUpgrade nodejs14-docsUpgrade nodejs10-develUpgrade nodejs16Upgrade nodejs16-devel | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade libnode72Upgrade nodejs-docUpgrade libnode64Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejsUpgrade nodejs (Ubuntu Pro)Upgrade libnode-dev | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub