Cyber Resilience

CVE-2022-32215

MediumPublic PoC

Published: 14 July 2022

Published
14 July 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.8647 99.4th percentile
Risk Priority 65 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-32215 is a medium-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Nodejs Node.Js. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The vulnerability is an HTTP request smuggling flaw (CWE-444) in the llhttp parser used by the http module of Node.js. It affects parser versions prior to 14.20.1, 16.17.1, and 18.9.1 and stems from incorrect handling of multi-line Transfer-Encoding headers, which can cause request parsing inconsistencies between front-end and back-end systems. The issue carries a CVSS 3.1 base score of 6.5.

An unauthenticated network attacker can send specially crafted HTTP requests containing malformed multi-line Transfer-Encoding headers. Successful exploitation allows the attacker to smuggle additional requests, resulting in limited impacts to confidentiality and integrity while bypassing security controls that rely on correct request boundary interpretation.

Vendor advisories and package updates published through channels such as Fedora mailing lists and Siemens SSA-332410 address the issue by updating to corrected llhttp versions; a detailed report is also available via the referenced HackerOne disclosure. The associated EPSS score has remained elevated since publication, with a recorded peak of 0.8887 and a current value of 0.8647.

EU & UK References

Vulnerability details

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

llhttp
llhttp
14.0.0 — 14.20.1 · 16.0.0 — 16.17.1 · 18.0.0 — 18.9.1
nodejs
node.js
14.0.0 — 14.14.0 · 14.15.0 — 14.20.0 · 16.0.0 — 16.12.0
fedoraproject
fedora
35, 36, 37
siemens
sinec ins
1.0
debian
debian linux
11.0
stormshield
stormshield management center
≤ 3.3.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References