CVE-2022-32215
Published: 14 July 2022
Summary
CVE-2022-32215 is a medium-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Nodejs Node.Js. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is an HTTP request smuggling flaw (CWE-444) in the llhttp parser used by the http module of Node.js. It affects parser versions prior to 14.20.1, 16.17.1, and 18.9.1 and stems from incorrect handling of multi-line Transfer-Encoding headers, which can cause request parsing inconsistencies between front-end and back-end systems. The issue carries a CVSS 3.1 base score of 6.5.
An unauthenticated network attacker can send specially crafted HTTP requests containing malformed multi-line Transfer-Encoding headers. Successful exploitation allows the attacker to smuggle additional requests, resulting in limited impacts to confidentiality and integrity while bypassing security controls that rely on correct request boundary interpretation.
Vendor advisories and package updates published through channels such as Fedora mailing lists and Siemens SSA-332410 address the issue by updating to corrected llhttp versions; a detailed report is also available via the referenced HackerOne disclosure. The associated EPSS score has remained elevated since publication, with a recorded peak of 0.8887 and a current value of 0.8647.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53417
Vulnerability details
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.