The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libs | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade v8-develUpgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade nodejs-full-i18n | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfo | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Jul 14, 2022 |
| Freebsd | — | Upgrade node14Upgrade node16Upgrade node | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-11-llvmUpgrade npmUpgrade nodejs-docsUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-11-espresso-llvmUpgrade nodejs-develUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-11-pythonUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-11Upgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-wasmUpgrade nodejs-libsUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-11-llvm-toolchainUpgrade nodejs-full-i18nUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-11-javascriptUpgrade nodejs-packagingUpgrade nodejsUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-develUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-11-native-image-llvm-backend | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-devel | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade npm | Mar 12, 2024 | Jul 14, 2022 |
| Suse | — | Upgrade corepack14Upgrade nodejs16-develUpgrade corepack18Upgrade npm16Upgrade nodejs18Upgrade nodejs10-develUpgrade nodejs16-docsUpgrade nodejs18-develUpgrade nodejs12-docsUpgrade npm14Upgrade nodejs14Upgrade nodejs14-develUpgrade npm18Upgrade nodejs18-docsUpgrade nodejs12-develUpgrade nodejs14-docsUpgrade nodejs10Upgrade nodejs12Upgrade corepack16Upgrade nodejs10-docsUpgrade npm10Upgrade npm12Upgrade nodejs16 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejs-docUpgrade nodejs (Ubuntu Pro)Upgrade libnode64Upgrade nodejsUpgrade libnode-devUpgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade libnode72 | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub