vulnerability

Red Hat: CVE-2021-22959: HTTP Request Smuggling due to spaces in headers (Multiple Advisories)

Name: Red Hat: CVE-2021-22959: HTTP Request Smuggling due to spaces in headers (Multiple Advisories)
Creator: Red Hat
Published: 2021-11-15T00:00:00.000Z
Keywords: CVE, CWE-444, Red Hat, 2021, 22959, HTTP Request Smuggling due to spaces in headers (Multiple Advisories), redhat-upgrade-nodejs, redhat-upgrade-nodejs-debuginfo, redhat-upgrade-nodejs-debugsource, redhat-upgrade-nodejs-devel, redhat-upgrade-nodejs-docs, redhat-upgrade-nodejs-full-i18n, redhat-upgrade-nodejs-nodemon, redhat-upgrade-nodejs-packaging, redhat-upgrade-npm, Severity 6

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:N)

Published

Nov 15, 2021

Added

Dec 17, 2021

Modified

Mar 27, 2026

Description

The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.

Solutions

redhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-npm

References

CWE-444
EUVD-EUVD-2021-10084
NVD-CVE-2021-22959
REDHAT-RHSA-2021:5171
REDHAT-RHSA-2022:0246
REDHAT-RHSA-2022:0350
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10084

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report