llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

MEDIUM 6.5CVE-2022-32213 · BIT-node-2022-32213 · BIT-node-min-2022-32213 · Published 14/07/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
llhttp llhttp	`≥ 6.0.0, < 6.0.7< 2.1.5`	`6.0.72.1.5`
node.js nodejs	`≥ 14.0.0, ≤ 14.14.0≥ 14.15.0, < 14.20.1≥ 16.0.0, ≤ 16.12.0≥ 16.13.0, < 16.17.1≥ 18.0.0, < 18.9.1`	`14.20.116.17.118.9.1`
sinec ins siemens	`= 1.0`	No fix yet
stormshield management center stormshield	`< 3.3.2`	`3.3.2`
llhttp npm	`< 6.0.7`	`6.0.7`

Description

The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Impacts:

All versions of the nodejs 18.x, 16.x, and 14.x releases lines.
llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js

NVD description

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free