CVE-2022-32214: XSS

Q: What is CVE-2022-32214?

CVE-2022-32214 is a vulnerability found in Node.js due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests.

Q: What is the severity of CVE-2022-32214?

The severity of CVE-2022-32214 is medium (6.5).

Q: How does CVE-2022-32214 relate to HTTP Request Smuggling (HRS)?

CVE-2022-32214 can lead to HTTP Request Smuggling (HRS) as it allows an attacker to send a specially crafted HTTP request to the server and smuggle arbitrary data.

Q: Which versions of Node.js are affected by CVE-2022-32214?

Node.js versions <v14.20.1, <v16.17.1, and <v18.9.1 are affected by CVE-2022-32214.

Q: How can I mitigate CVE-2022-32214?

To mitigate CVE-2022-32214, update Node.js to versions 14.20.1, 16.17.1, or 18.9.1 or later.

Published Jul 8, 2022

Updated

A vulnerability was found in NodeJS due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests. This issue can lead to HTTP Request Smuggling (HRS). This flaw allows an attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers, causing web cache poisoning, and conducting XSS attacks.

Affected Software

16 affected componentsFixes available

redhat/nodejs<1:16.16.0-1.el9_0

1:16.16.0-1.el9_0

redhat/rh-nodejs14-nodejs<0:14.20.0-2.el7

0:14.20.0-2.el7

debian/nodejs

10.24.0~dfsg-1~deb10u110.24.0~dfsg-1~deb10u312.22.12~dfsg-1~deb11u418.13.0+dfsg1-1

redhat/nodejs<14.20.0

14.20.0

redhat/nodejs<16.20.0

16.20.0

redhat/nodejs<18.5.0

18.5.0

IBM Cognos Controller<=11.0.0 - 11.0.1

llhttp Llhttp Node.js<2.1.5

llhttp Llhttp Node.js>=6.0.0<6.0.7

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.15.0<14.20.0

Nodejs Node.js>=16.0.0<=16.12.0

Nodejs Node.js>=16.13.0<16.16.0

Nodejs Node.js>=18.0.0<18.5.0

Debian Debian Linux=11.0

Stormshield Stormshield Management Center<3.3.0

Remediation

Patch Available

https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

Event History

Jul 8, 2022

CVE Published

12:00 AM

Jul 14, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2022-32214?

CVE-2022-32214 is a vulnerability found in Node.js due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests.

What is the severity of CVE-2022-32214?

The severity of CVE-2022-32214 is medium (6.5).

How does CVE-2022-32214 relate to HTTP Request Smuggling (HRS)?