Skip to content
Fencer Vulns
medium 6.5

CVE-2022-32213 json

llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

published 2022-07-14 4 y ago modified 2026-10-16 24 d ago also BIT-node-2022-32213 , BIT-node-min-2022-32213 , EUVD-2022-6237 , GHSA-5689-v88g-g6rv

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
44.8%
EPSS 44.8% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Patch / fix

  • npm llhttp 6.0.7
  • bitnami node 14.14.1, 14.20.1, 16.12.1, 16.17.1, 18.9.1
  • bitnami node-min 14.14.1, 14.20.1, 16.12.1, 16.17.1, 18.9.1
  • NodeJS Node 14.20.1, 16.17.1, 18.9.1
  • nodejs Debian 14, Debian 13, Debian 12 18.6.0+dfsg-3

debian advisories DEBIAN-CVE-2022-32213

  • nodejs Ubuntu 22.04 LTS 12.22.9~dfsg-1ubuntu3.2

ubuntu advisories UBUNTU-CVE-2022-32213

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • npm RHEL 8 1:8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185
  • nodejs RHEL 8 1:16.16.0-3.module+el8.6.0+16248+76b0e185
  • nodejs-nodemon RHEL 8 2.0.19-2.module+el8.6.0+16240+7ca51420
  • nodejs-full-i18n RHEL 8 1:16.16.0-3.module+el8.6.0+16248+76b0e185
  • nodejs-packaging RHEL 8 25-1.module+el8.5.0+10992+fac5fe06
  • npm RHEL 8 1:6.14.17-1.14.20.0.2.module+el8.6.0+16231+7c1b33d9
  • nodejs RHEL 8 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9
  • nodejs-nodemon RHEL 8 2.0.19-2.module+el8.6.0+16231+7c1b33d9

red hat advisories RHSA-2022:6449RHSA-2022:6448RHSA-2022:6985RHSA-2022:6595RHSA-2022:6389

  • nodejs18 SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.5, openSUSE Leap 15.4 18.13.0-150400.9.3.1
  • nodejs18 SLE Module for Web and Scripting 12 18.13.0-8.3.1
  • nodejs10 openSUSE Leap 15.4, openSUSE Leap 15.3 10.24.1-150000.1.50.1
  • nodejs16 SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.4 16.17.1-150400.3.9.1
  • nodejs12 SLE Module for Web and Scripting 15 SP3, openSUSE Leap 15.4, openSUSE Leap 15.3 12.22.12-150200.4.38.1
  • nodejs16 SLE Module for Web and Scripting 15 SP3, openSUSE Leap 15.3 16.17.1-150300.7.12.1
  • nodejs14 SLE Module for Web and Scripting 15 SP3, openSUSE Leap 15.4, openSUSE Leap 15.3 14.20.1-150200.15.37.1
  • nodejs16 SLE Module for Web and Scripting 12 16.17.1-8.12.1

suse advisories SUSE-SU-2023:0419-1SUSE-SU-2023:0408-1SUSE-SU-2022:3835-1SUSE-SU-2022:3656-1SUSE-SU-2022:3616-1SUSE-SU-2022:3615-1

  • python-httptools openSUSE Tumbleweed 0.6.1-1.9
  • nodejs16 openSUSE Tumbleweed 16.16.0-1.1
  • nodejs18 openSUSE Tumbleweed 18.9.0-1.1

opensuse advisories openSUSE-SU-2025:15095-1openSUSE-SU-2024:12199-1openSUSE-SU-2024:12349-1

  • nodejs AlmaLinux 9 1:16.16.0-1.el9_0
  • nodejs-nodemon AlmaLinux 9 2.0.19-1.el9_0
  • npm AlmaLinux 9 1:8.11.0-1.16.16.0.1.el9_0
  • nodejs-libs AlmaLinux 9 1:16.16.0-1.el9_0
  • nodejs-full-i18n AlmaLinux 9 1:16.16.0-1.el9_0
  • npm AlmaLinux 8 1:6.14.17-1.14.20.0.2.module_el8.6.0+3261+490666b3
  • nodejs AlmaLinux 8 1:14.20.0-2.module_el8.6.0+3261+490666b3
  • nodejs-nodemon AlmaLinux 8 2.0.19-2.module_el8.6.0+3261+490666b3

almalinux advisories ALSA-2022:6595ALSA-2022:6448

  • nodejs-nodemon Rocky Linux 9 2.0.19-1.el9_0
  • nodejs Rocky Linux 8 1:16.16.0-3.module+el8.6.0+1003+ae94235a
  • nodejs-nodemon Rocky Linux 8 2.0.19-2.module+el8.6.0+1046+80feca58
  • nodejs-nodemon Rocky Linux 8 2.0.19-2.module+el8.6.0+1003+ae94235a
  • nodejs-packaging Rocky Linux 8 25-1.module+el8.6.0+1046+80feca58
  • nodejs-packaging Rocky Linux 8 25-1.module+el8.5.0+702+221f14e6
  • nodejs Rocky Linux 8 1:14.20.0-2.module+el8.6.0+1004+df064614
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8

rocky linux advisories RLSA-2022:6595RLSA-2022:6449RLSA-2022:6448

  • nodejs Alpine 3.14, Alpine 3.13 14.20.1-r0
  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 16.17.1-r0
  • nodejs-current Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 18.9.1-r0

alpine advisories ALPINE-CVE-2022-32213

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nodejs CBL-Mariner 2.0 16.20.2-4
  • rust Azure Linux 3.0 1.75.0-1

azure linux advisories AZL-10150AZL-41051

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-32213 updated cvss 6.5

nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding

  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 14.20.0-2.module+el8.6.0+16231+7c1b33d9, nodejs 16.16.0-3.module+el8.6.0+16248+76b0e185, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, npm 8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185, nodejs-nodemon 2.0.19-2.module+el8.6.0+16231+7c1b33d9, +4 more
    fixed: vendor fix RHSA-2022:6448
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.16.0-1.el9_0, nodejs-libs 16.16.0-1.el9_0, npm 8.11.0-1.16.16.0.1.el9_0, nodejs-full-i18n 16.16.0-1.el9_0
    fixed: vendor fix RHSA-2022:6595
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs 14.20.0-2.module+el8.4.0+16234+70f4adc8, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.19-2.module+el8.4.0+16234+70f4adc8, npm 6.14.17-1.14.20.0.2.module+el8.4.0+16234+70f4adc8, nodejs-full-i18n 14.20.0-2.module+el8.4.0+16234+70f4adc8
    fixed: vendor fix RHSA-2022:6985
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs 14.20.0-2.el7, rh-nodejs14-npm 6.14.17-14.20.0.2.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs 14.20.0-2.el7, rh-nodejs14-npm 6.14.17-14.20.0.2.el7
    fixed: vendor fix RHSA-2022:6389
  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux AppStream (v. 9) nodejs-nodemon 2.0.19-1.el9_0 Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-nodemon 2.0.19-1.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-nodemon 2.0.19-1.el7
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

44.84% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • hackerone.com https://hackerone.com/reports/1524555 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm llhttp
<6.0.7
6.0.7
bitnami node
>=14.0.0, <14.14.1
>=14.15.0, <14.20.1
>=16.0.0, <16.12.1
>=16.13.0, <16.17.1
>=18.0.0, <18.9.1
14.14.1
14.20.1
16.12.1
16.17.1
18.9.1
bitnami node-min
>=14.0.0, <14.14.1
>=14.15.0, <14.20.1
>=16.0.0, <16.12.1
>=16.13.0, <16.17.1
>=18.0.0, <18.9.1
14.14.1
14.20.1
16.12.1
16.17.1
18.9.1

Affected products

  • NodeJS Node

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.