The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-libsUpgrade npmUpgrade nodejs | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docsUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade v8-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsource | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade npm | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade node14Upgrade nodeUpgrade node16 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-17-wasmUpgrade nodejs-packagingUpgrade graalvm22-ce-17-native-imageUpgrade nodejs-develUpgrade graalvm22-ce-11Upgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-11-libpolyglotUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-17-develUpgrade nodejs-docsUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-python-develUpgrade nodejsUpgrade graalvm22-ce-11-espresso-llvmUpgrade npmUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-11-develUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-11-javascriptUpgrade nodejs-libsUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-17-javascriptUpgrade nodejs-full-i18nUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-python-devel | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-libs-debuginfo | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-develUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade nodejs12-develUpgrade nodejs16-docsUpgrade corepack18Upgrade nodejs18-docsUpgrade nodejs14-develUpgrade nodejs18Upgrade npm16Upgrade nodejs12-docsUpgrade nodejs10-develUpgrade nodejs12Upgrade npm10Upgrade nodejs16-develUpgrade corepack16Upgrade nodejs18-develUpgrade npm14Upgrade npm12Upgrade nodejs10-docsUpgrade nodejs16Upgrade corepack14Upgrade nodejs14-docsUpgrade npm18Upgrade nodejs14Upgrade nodejs10 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejsUpgrade nodejs (Ubuntu Pro)Upgrade libnode64Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-docUpgrade libnode-devUpgrade libnode72Upgrade nodejs-doc (Ubuntu Pro) | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub