CVE-2022-32214
Published: 14 July 2022
Summary
CVE-2022-32214 is a medium-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Nodejs Node.Js. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is an HTTP request smuggling flaw (CWE-444) in the llhttp parser used by the http module in Node.js. It affects versions of the parser prior to 14.20.1, 16.17.1, and 18.9.1, which fail to strictly require the CRLF sequence to delimit requests.
An unauthenticated remote attacker can send specially crafted HTTP requests that exploit the lenient parsing to smuggle additional requests. Successful exploitation can allow the attacker to bypass access controls or poison caches, resulting in limited impacts to confidentiality and integrity as reflected in the CVSS 6.5 score.
Node.js security releases and associated advisories, including those from Debian, direct users to upgrade the http module and llhttp parser to the fixed versions listed in the July 2022 Node.js release notes. The EPSS score reached a peak of 0.4973 with a current value of 0.3929.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6393
Vulnerability details
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.