The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade npmUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-full-i18n | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade v8-develUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-libsUpgrade npm | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade node16Upgrade nodeUpgrade node14 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-11Upgrade graalvm22-ce-17-ruby-develUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-11-llvmUpgrade nodejs-docsUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-17-develUpgrade nodejs-packagingUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-17-pythonUpgrade npmUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17Upgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-polyglotUpgrade nodejs-libsUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-python-develUpgrade nodejsUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-develUpgrade nodejs-full-i18n | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade npmUpgrade nodejs-develUpgrade nodejs-docs | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsource | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade corepack18Upgrade nodejs16Upgrade nodejs16-develUpgrade nodejs18-develUpgrade nodejs12-develUpgrade nodejs16-docsUpgrade nodejs18-docsUpgrade npm14Upgrade nodejs14-develUpgrade nodejs18Upgrade nodejs12Upgrade npm10Upgrade npm12Upgrade nodejs10-develUpgrade nodejs10-docsUpgrade corepack16Upgrade nodejs12-docsUpgrade npm16Upgrade nodejs14-docsUpgrade nodejs14Upgrade nodejs10Upgrade npm18Upgrade corepack14 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libnode64Upgrade nodejsUpgrade nodejs-docUpgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro)Upgrade libnode72 | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub