The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemon | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docsUpgrade npmUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade v8-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsource | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packaging | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade node14Upgrade node16Upgrade node | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-11-rubyUpgrade nodejs-packagingUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-11Upgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-17-native-imageUpgrade nodejs-docsUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-17-toolsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-11-espresso-llvmUpgrade npmUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-17Upgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-17-fastrUpgrade nodejs-libsUpgrade nodejsUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-11-develUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-polyglot | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-full-i18n | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debuginfo | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade npm14Upgrade nodejs14-develUpgrade corepack18Upgrade corepack16Upgrade nodejs12-develUpgrade nodejs18-develUpgrade nodejs12Upgrade npm12Upgrade nodejs18-docsUpgrade npm16Upgrade npm10Upgrade nodejs18Upgrade nodejs10-develUpgrade nodejs16Upgrade nodejs16-develUpgrade nodejs16-docsUpgrade nodejs10-docsUpgrade nodejs12-docsUpgrade corepack14Upgrade nodejs14Upgrade nodejs14-docsUpgrade nodejs10Upgrade npm18 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade libnode64Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-docUpgrade nodejsUpgrade nodejs (Ubuntu Pro)Upgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro)Upgrade libnode72 | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub