The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejsUpgrade npm | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade npm | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-libs | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade node16Upgrade nodeUpgrade node14 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-11-fastrUpgrade nodejs-develUpgrade graalvm22-ce-11-toolsUpgrade nodejs-packagingUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-11Upgrade nodejs-docsUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-develUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-17-fastrUpgrade nodejs-libsUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-espresso-llvmUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-espresso-llvmUpgrade npmUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-11-pythonUpgrade nodejsUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-11-espresso | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-docsUpgrade npm | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-devel | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade nodejs10-docsUpgrade nodejs12Upgrade nodejs16-develUpgrade nodejs18-develUpgrade nodejs14-develUpgrade nodejs12-develUpgrade corepack16Upgrade corepack18Upgrade nodejs12-docsUpgrade nodejs16-docsUpgrade npm12Upgrade nodejs18Upgrade npm16Upgrade npm10Upgrade nodejs16Upgrade nodejs10-develUpgrade npm14Upgrade nodejs18-docsUpgrade corepack14Upgrade nodejs10Upgrade npm18Upgrade nodejs14-docsUpgrade nodejs14 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro)Upgrade libnode72Upgrade nodejsUpgrade nodejs-docUpgrade libnode64Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro) | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub