CVE-2022-35256: XSS
A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Other sources
Node.js is vulnerable to HTTP request smuggling, caused by the failure to correctly handle header fields that are not terminated with CLRF by the llhttp parser in the http module. A remote attacker could send a specially-crafted request to lead to HTTP Request Smuggling (HRS). An attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
— IBM
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
The llhttp parser in the http module in Node.js v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
Impacts: All versions of the 18.x, 16.x, and 14.x release lines. llhttp v6.0.10 contains the fixes that were updated inside Node.js
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this NodeJS vulnerability?
The vulnerability ID of this NodeJS vulnerability is CVE-2022-35256.
What is the severity of CVE-2022-35256?
The severity of CVE-2022-35256 is medium.
What is the affected software for CVE-2022-35256?
The affected software for CVE-2022-35256 is NodeJS versions 16.17.1-1.el9_0, 16.18.1-3.el9_1, 14.20.1, 16.17.1, and 18.9.1.
What is the description of CVE-2022-35256?
CVE-2022-35256 is a vulnerability in NodeJS due to improper validation of HTTP requests, allowing a remote attacker to send a potentially malicious request.
How can I fix CVE-2022-35256?
To fix CVE-2022-35256, it is recommended to update NodeJS to a version that includes the necessary security patches.