Skip to content
Fencer Vulns
medium 6.5

CVE-2022-32214 json

llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

published 2022-07-14 4 y ago modified 2026-09-10 1 mo ago also BIT-node-2022-32214 , BIT-node-min-2022-32214 , EUVD-2022-6393 , GHSA-q5vx-44v4-gch4

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
81.8%
EPSS 81.8% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known

Summary

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

Patch / fix

  • npm llhttp 6.0.7
  • bitnami node 14.14.1, 14.20.0, 16.12.1, 16.16.0, 18.5.0
  • bitnami node-min 14.14.1, 14.20.0, 16.12.1, 16.16.0, 18.5.0
  • NodeJS Node 14.20.0, 16.20.0, 18.5.0
  • nodejs Debian 14, Debian 13, Debian 12 18.6.0+dfsg-3

debian advisories DEBIAN-CVE-2022-32214

  • nodejs Ubuntu 22.04 LTS 12.22.9~dfsg-1ubuntu3.2

ubuntu advisories UBUNTU-CVE-2022-32214

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • npm RHEL 8 1:8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185
  • nodejs RHEL 8 1:16.16.0-3.module+el8.6.0+16248+76b0e185
  • nodejs-nodemon RHEL 8 2.0.19-2.module+el8.6.0+16240+7ca51420
  • nodejs-full-i18n RHEL 8 1:16.16.0-3.module+el8.6.0+16248+76b0e185
  • nodejs-packaging RHEL 8 25-1.module+el8.5.0+10992+fac5fe06
  • npm RHEL 8 1:6.14.17-1.14.20.0.2.module+el8.6.0+16231+7c1b33d9
  • nodejs RHEL 8 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9
  • nodejs-nodemon RHEL 8 2.0.19-2.module+el8.6.0+16231+7c1b33d9

red hat advisories RHSA-2022:6449RHSA-2022:6448RHSA-2022:6985RHSA-2022:6595RHSA-2022:6389

  • nodejs18 SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.5, openSUSE Leap 15.4 18.13.0-150400.9.3.1
  • nodejs18 SLE Module for Web and Scripting 12 18.13.0-8.3.1
  • nodejs10 SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +18 more 10.24.1-150000.1.47.1
  • nodejs16 SLE Module for Web and Scripting 15 SP3, openSUSE Leap 15.3 16.16.0-150300.7.6.2
  • nodejs16 SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.4 16.16.0-150400.3.3.2
  • nodejs12 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 12.22.12-150200.4.35.1
  • nodejs14 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +9 more 14.20.0-150200.15.34.1
  • nodejs12 SLE Module for Web and Scripting 12 12.22.12-1.51.1

suse advisories SUSE-SU-2023:0419-1SUSE-SU-2023:0408-1SUSE-SU-2022:2855-1SUSE-SU-2022:2551-1SUSE-SU-2022:2491-1SUSE-SU-2022:2430-1

  • nodejs AlmaLinux 9 1:16.16.0-1.el9_0
  • nodejs-nodemon AlmaLinux 9 2.0.19-1.el9_0
  • npm AlmaLinux 9 1:8.11.0-1.16.16.0.1.el9_0
  • nodejs-libs AlmaLinux 9 1:16.16.0-1.el9_0
  • nodejs-full-i18n AlmaLinux 9 1:16.16.0-1.el9_0
  • npm AlmaLinux 8 1:6.14.17-1.14.20.0.2.module_el8.6.0+3261+490666b3
  • nodejs AlmaLinux 8 1:14.20.0-2.module_el8.6.0+3261+490666b3
  • nodejs-nodemon AlmaLinux 8 2.0.19-2.module_el8.6.0+3261+490666b3

almalinux advisories ALSA-2022:6595ALSA-2022:6448

  • nodejs-nodemon Rocky Linux 9 2.0.19-1.el9_0
  • nodejs Rocky Linux 8 1:16.16.0-3.module+el8.6.0+1003+ae94235a
  • nodejs-nodemon Rocky Linux 8 2.0.19-2.module+el8.6.0+1046+80feca58
  • nodejs-nodemon Rocky Linux 8 2.0.19-2.module+el8.6.0+1003+ae94235a
  • nodejs-packaging Rocky Linux 8 25-1.module+el8.6.0+1046+80feca58
  • nodejs-packaging Rocky Linux 8 25-1.module+el8.5.0+702+221f14e6
  • nodejs Rocky Linux 8 1:14.20.0-2.module+el8.6.0+1004+df064614
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8

rocky linux advisories RLSA-2022:6595RLSA-2022:6449RLSA-2022:6448

  • nodejs Alpine 3.14, Alpine 3.13 14.20.1-r0
  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 16.17.1-r0
  • nodejs-current Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 18.6.0-r0

alpine advisories ALPINE-CVE-2022-32214

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nodejs CBL-Mariner 2.0 16.16.0-1
  • rust Azure Linux 3.0 1.75.0-1

azure linux advisories AZL-10151AZL-40893

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-32214 updated cvss 6.5

nodejs: HTTP request smuggling due to improper delimiting of header fields

  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 14.20.0-2.module+el8.6.0+16231+7c1b33d9, nodejs 16.16.0-3.module+el8.6.0+16248+76b0e185, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, npm 8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185, nodejs-nodemon 2.0.19-2.module+el8.6.0+16231+7c1b33d9, +4 more
    fixed: vendor fix RHSA-2022:6448
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.16.0-1.el9_0, nodejs-libs 16.16.0-1.el9_0, npm 8.11.0-1.16.16.0.1.el9_0, nodejs-full-i18n 16.16.0-1.el9_0
    fixed: vendor fix RHSA-2022:6595
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs 14.20.0-2.module+el8.4.0+16234+70f4adc8, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.19-2.module+el8.4.0+16234+70f4adc8, npm 6.14.17-1.14.20.0.2.module+el8.4.0+16234+70f4adc8, nodejs-full-i18n 14.20.0-2.module+el8.4.0+16234+70f4adc8
    fixed: vendor fix RHSA-2022:6985
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs 14.20.0-2.el7, rh-nodejs14-npm 6.14.17-14.20.0.2.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs 14.20.0-2.el7, rh-nodejs14-npm 6.14.17-14.20.0.2.el7
    fixed: vendor fix RHSA-2022:6389
  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux AppStream (v. 9) nodejs-nodemon 2.0.19-1.el9_0 Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-nodemon 2.0.19-1.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-nodemon 2.0.19-1.el7
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

81.83% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • hackerone.com https://hackerone.com/reports/1524692 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm llhttp
<6.0.7
6.0.7
bitnami node
>=14.0.0, <14.14.1
>=14.15.0, <14.20.0
>=16.0.0, <16.12.1
>=16.13.0, <16.16.0
>=18.0.0, <18.5.0
14.14.1
14.20.0
16.12.1
16.16.0
18.5.0
bitnami node-min
>=14.0.0, <14.14.1
>=14.15.0, <14.20.0
>=16.0.0, <16.12.1
>=16.13.0, <16.16.0
>=18.0.0, <18.5.0
14.14.1
14.20.0
16.12.1
16.16.0
18.5.0

Affected products

  • NodeJS Node

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.