The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-devel | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade v8-develUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-full-i18n | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npm | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade nodeUpgrade node16Upgrade node14 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-11-jdkUpgrade nodejs-full-i18nUpgrade nodejsUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-17-rubyUpgrade npmUpgrade nodejs-libsUpgrade graalvm22-ce-11-develUpgrade nodejs-packagingUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-11-rubyUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-17-espresso-llvmUpgrade nodejs-develUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-11Upgrade nodejs-docsUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-17-native-image-llvm-backend | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-debuginfo | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade nodejs14-develUpgrade npm14Upgrade nodejs10Upgrade nodejs14Upgrade corepack18Upgrade nodejs16-docsUpgrade nodejs12-docsUpgrade npm16Upgrade corepack14Upgrade nodejs16Upgrade npm18Upgrade corepack16Upgrade nodejs10-develUpgrade nodejs12-develUpgrade nodejs16-develUpgrade nodejs12Upgrade nodejs10-docsUpgrade nodejs18-develUpgrade nodejs14-docsUpgrade nodejs18-docsUpgrade npm10Upgrade nodejs18Upgrade npm12 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejsUpgrade nodejs (Ubuntu Pro)Upgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro)Upgrade libnode64Upgrade nodejs-docUpgrade libnode72 | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub