The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-docs | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade v8-develUpgrade npm | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfo | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade nodeUpgrade node16Upgrade node14 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-17-espresso-llvmUpgrade nodejsUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-11-develUpgrade nodejs-libsUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-17-libpolyglotUpgrade nodejs-packagingUpgrade graalvm22-ce-11-rubyUpgrade nodejs-full-i18nUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-11Upgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-11-toolsUpgrade nodejs-docsUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-17-nodejs-develUpgrade nodejs-develUpgrade npmUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-11-llvmUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-libpolyglot | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-libs-debuginfo | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-devel | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade npm14Upgrade nodejs18Upgrade nodejs16-develUpgrade nodejs14Upgrade nodejs16-docsUpgrade nodejs18-develUpgrade nodejs12-docsUpgrade corepack18Upgrade nodejs14-develUpgrade npm16Upgrade nodejs10-develUpgrade corepack14Upgrade nodejs16Upgrade npm18Upgrade nodejs18-docsUpgrade nodejs12-develUpgrade nodejs10Upgrade corepack16Upgrade nodejs12Upgrade nodejs14-docsUpgrade nodejs10-docsUpgrade npm10Upgrade npm12 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade libnode64Upgrade nodejs-docUpgrade nodejs-dev (Ubuntu Pro)Upgrade libnode-devUpgrade libnode72Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub