CVE-2022-32213: XSS
A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This issue can lead to HTTP Request Smuggling (HRS), causing web cache poisoning, and conducting XSS attacks.
Other sources
CVE-2022-32213
The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
More details will be available at CVE-2022-32213 after publication.
Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.
Impacts:
All versions of the 18.x, 16.x, and 14.x releases lines. llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js
— Red Hat
Node.js is vulnerable to HTTP request smuggling, caused by the failure to correctly parse and validate Transfer-Encoding headers by the llhttp parser in the http module. A remote attacker could send a specially-crafted request to lead to HTTP Request Smuggling (HRS). An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-32213?
CVE-2022-32213 is a vulnerability found in NodeJS due to improper validation of HTTP requests.
How does CVE-2022-32213 impact web applications?
CVE-2022-32213 can lead to HTTP Request Smuggling (HRS), causing web cache poisoning, and conducting XSS attacks.
What software versions are affected by CVE-2022-32213?
Versions of llhttp <v14.20.1, <v16.17.1, and <v18.9.1 in the http module in Node.js are affected.
What is the severity of CVE-2022-32213?
CVE-2022-32213 has a severity rating of 6.5 (medium).
How can I fix CVE-2022-32213?
To fix CVE-2022-32213, update Node.js to a version equal to or above v14.20.1, v16.17.1, or v18.9.1.