Fluid Attacks Database

Description

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.14	nodejs	>=0 <14.20.1-r0	14.20.1-r0
alpine v3.21	nodejs	>=0 <16.17.1-r0	16.17.1-r0
alpine v3.19	nodejs	>=0 <16.17.1-r0	16.17.1-r0
debian 14	nodejs	>=0 <18.10.0+dfsg-1	18.10.0+dfsg-1
alpine v3.13	nodejs	>=0 <14.20.1-r0	14.20.1-r0
alpine v3.15	nodejs	>=0 <16.17.1-r0	16.17.1-r0
alpine v3.16	nodejs	>=0 <16.17.1-r0	16.17.1-r0
alpine v3.17	nodejs	>=0 <16.17.1-r0	16.17.1-r0
alpine v3.20	nodejs	>=0 <16.17.1-r0	16.17.1-r0
alpine v3.22	nodejs	>=0 <16.17.1-r0	16.17.1-r0

1-10 of 22

Aliases

1. CVE-2022-352562. NVD-2022-352563. OSV-ALPINE-2022-352564. OSV-2022-352565. OSV-DEBIAN-2022-352566. GCVE-2022-352567. SECURITY-CVE-2022-352568. SECURITY-TRACKER-CVE-2022-352569. https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35256.json10. DEBIAN-dsa-5326

References

1. https://hackerone.com/reports/16751912. https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.