CVE-2022-32213

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-444

Affected software

Vendor	Product	Versions
NodeJS	Node	>= 4.0, < 4.; >= 5.0, < 5.; >= 6.0, < 6.; >= 7.0, < 7.; >= 8.0, < 8.; >= 9.0, < 9.; >= 10.0, < 10.; >= 11.0, < 11.; >= 12.0, < 12.; >= 13.0, < 13.; >= 14.0, < 14.20.1; >= 15.0, < 15.; >= 16.0, < 16.17.1; >= 17.0, < 17.; >= 18.0, < 18.9.1

References

Timeline

Published: Jul 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-322146.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP re CVE-2022-322156.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding hea CVE-2022-322175.3A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.CVE-2022-322184.3An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allo CVE-2022-322194.3An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter fr CVE-2022-32225.5Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV.CVE-2022-322206.5An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses message CVE-2022-322219.8When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when th CVE-2022-322225.3A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf t CVE-2022-322237.3Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploi CVE-2022-322249.8A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2 CVE-2022-322256.1A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0.