The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-full-i18nUpgrade v8-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-libs | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18n | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade node14Upgrade node16Upgrade node | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-17-toolsUpgrade nodejs-docsUpgrade graalvm22-ce-11Upgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-17-native-imageUpgrade nodejs-develUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-11-javascriptUpgrade npmUpgrade nodejs-libsUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-11-develUpgrade graalvm22-ce-11-polyglotUpgrade nodejsUpgrade graalvm22-ce-11-llvm-toolchainUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-17Upgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-17-ruby-devel | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18n | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade npm | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade nodejs12Upgrade nodejs10-docsUpgrade nodejs10-develUpgrade nodejs16Upgrade nodejs12-develUpgrade nodejs14-docsUpgrade nodejs18-docsUpgrade npm10Upgrade nodejs16-develUpgrade npm12Upgrade npm18Upgrade nodejs18-develUpgrade corepack16Upgrade nodejs18Upgrade npm14Upgrade corepack14Upgrade nodejs16-docsUpgrade nodejs14-develUpgrade corepack18Upgrade nodejs10Upgrade npm16Upgrade nodejs12-docsUpgrade nodejs14 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libnode-devUpgrade nodejsUpgrade libnode64Upgrade nodejs-doc (Ubuntu Pro)Upgrade libnode72Upgrade nodejs-doc | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub