CVE-2022-35256
MediumPublic PoC
Published: 05 December 2022
Published
05 December 2022
Modified
24 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score
0.0369
88.2th percentile
Risk Priority
15
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2022-35256 is a medium-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Nodejs Node.Js. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 11.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38147
Vulnerability details
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
nodejs
node.js
14.0.0 — 14.14.0 · 14.15.0 — 14.20.1 · 16.0.0 — 16.12.0
llhttp
llhttp
≤ 6.0.10
siemens
sinec ins
1.0 · ≤ 1.0
debian
debian linux
11.0
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.