The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-libsUpgrade npmUpgrade nodejs | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-devel | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade node16Upgrade nodeUpgrade node14 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-python-develUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-17Upgrade nodejsUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-11-develUpgrade npmUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-17-javascriptUpgrade nodejs-libsUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-11-nodejs-develUpgrade nodejs-develUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-11-llvmUpgrade nodejs-docsUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-11Upgrade nodejs-nodemonUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-17-nodejsUpgrade nodejs-packagingUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-fastr | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade npmUpgrade nodejs-develUpgrade nodejs-docs | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfo | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade npm10Upgrade nodejs12-develUpgrade corepack16Upgrade nodejs18Upgrade nodejs12-docsUpgrade npm14Upgrade nodejs14-develUpgrade nodejs10-docsUpgrade nodejs18-docsUpgrade corepack18Upgrade nodejs10-develUpgrade nodejs16-docsUpgrade nodejs12Upgrade nodejs16-develUpgrade nodejs18-develUpgrade npm16Upgrade nodejs16Upgrade npm12Upgrade corepack14Upgrade npm18Upgrade nodejs10Upgrade nodejs14-docsUpgrade nodejs14 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode64Upgrade nodejsUpgrade nodejs-docUpgrade nodejs (Ubuntu Pro)Upgrade libnode72Upgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro) | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub