CVE-2022-32215: XSS
A vulnerability was found in NodeJS due to the llhttp parser in the HTTP module incorrectly handling multi-line Transfer-Encoding headers. This issue can lead to HTTP Request Smuggling (HRS). This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers, causing web cache poisoning, and conducting XSS attacks.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-32215?
CVE-2022-32215 is a vulnerability in NodeJS due to the llhttp parser in the HTTP module incorrectly handling multi-line Transfer-Encoding headers.
What is the severity of CVE-2022-32215?
The severity of CVE-2022-32215 is medium with a CVSS score of 6.5.
How does CVE-2022-32215 affect NodeJS?
CVE-2022-32215 can lead to HTTP Request Smuggling (HRS) and allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP traffic.
How can I fix CVE-2022-32215?
To fix CVE-2022-32215, users should update to the patched versions: llhttp v14.20.1, v16.17.1, or v18.9.1 in the Node.js http module.
Where can I find more information about CVE-2022-32215?
You can find more information about CVE-2022-32215 on the CVE website, NIST NVD, Node.js blog, Red Hat Bugzilla, and Red Hat Advisory.