CVE-2022-32215: XSS
A vulnerability was found in NodeJS due to the llhttp parser in the HTTP module incorrectly handling multi-line Transfer-Encoding headers. This issue can lead to HTTP Request Smuggling (HRS). This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers, causing web cache poisoning, and conducting XSS attacks.
Other sources
CVE-2022-32215
The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
More details will be available at CVE-2022-32215 after publication.
Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.
Impacts:
All versions of the 18.x, 16.x, and 14.x releases lines. llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
— Red Hat
Node.js is vulnerable to HTTP request smuggling, caused by the failure to correctly handle multi-line Transfer-Encoding headers by the llhttp parser in the http module. A remote attacker could send a specially-crafted request to lead to HTTP Request Smuggling (HRS). An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
The llhttp parser <v14.20.1 <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
— Microsoft
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-32215?
CVE-2022-32215 is a vulnerability in NodeJS due to the llhttp parser in the HTTP module incorrectly handling multi-line Transfer-Encoding headers.
What is the severity of CVE-2022-32215?
The severity of CVE-2022-32215 is medium with a CVSS score of 6.5.
How does CVE-2022-32215 affect NodeJS?
CVE-2022-32215 can lead to HTTP Request Smuggling (HRS) and allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP traffic.
How can I fix CVE-2022-32215?
To fix CVE-2022-32215, users should update to the patched versions: llhttp v14.20.1, v16.17.1, or v18.9.1 in the Node.js http module.
Where can I find more information about CVE-2022-32215?
You can find more information about CVE-2022-32215 on the CVE website, NIST NVD, Node.js blog, Red Hat Bugzilla, and Red Hat Advisory.