CVE-2022-35256: XSS

Q: What is the vulnerability ID of this NodeJS vulnerability?

The vulnerability ID of this NodeJS vulnerability is CVE-2022-35256.

Q: What is the severity of CVE-2022-35256?

The severity of CVE-2022-35256 is medium.

Q: What is the affected software for CVE-2022-35256?

The affected software for CVE-2022-35256 is NodeJS versions 16.17.1-1.el9_0, 16.18.1-3.el9_1, 14.20.1, 16.17.1, and 18.9.1.

Q: What is the description of CVE-2022-35256?

CVE-2022-35256 is a vulnerability in NodeJS due to improper validation of HTTP requests, allowing a remote attacker to send a potentially malicious request.

Q: How can I fix CVE-2022-35256?

To fix CVE-2022-35256, it is recommended to update NodeJS to a version that includes the necessary security patches.

Published Sep 23, 2022

Updated

A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Affected Software

20 affected componentsFixes available

redhat/nodejs<1:16.17.1-1.el9_0

1:16.17.1-1.el9_0

redhat/nodejs<1:16.18.1-3.el9_1

1:16.18.1-3.el9_1

redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7

0:14.20.1-2.el7

debian/nodejs

10.24.0~dfsg-1~deb10u110.24.0~dfsg-1~deb10u312.22.12~dfsg-1~deb11u418.13.0+dfsg1-1

redhat/NodeJS<14.20.1

14.20.1

redhat/Nodejs<16.17.1

16.17.1

redhat/Nodejs<18.9.1

18.9.1

redhat/llhttp<6.0.10

6.0.10

IBM Cognos Controller<=11.0.0 - 11.0.1

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.15.0<14.20.1

Nodejs Node.js>=16.0.0<=16.12.0

Nodejs Node.js>=16.13.0<16.17.1

Nodejs Node.js>=18.0.0<18.9.1

llhttp Llhttp Node.js<6.0.10

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

Siemens Sinec Ins=1.0-sp1

Siemens Sinec Ins=1.0-sp2

Debian Debian Linux=11.0

Event History

Sep 23, 2022

CVE Published

12:00 AM

Dec 5, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID of this NodeJS vulnerability?

The vulnerability ID of this NodeJS vulnerability is CVE-2022-35256.

What is the severity of CVE-2022-35256?

The severity of CVE-2022-35256 is medium.

What is the affected software for CVE-2022-35256?

The affected software for CVE-2022-35256 is NodeJS versions 16.17.1-1.el9_0, 16.18.1-3.el9_1, 14.20.1, 16.17.1, and 18.9.1.

What is the description of CVE-2022-35256?

CVE-2022-35256 is a vulnerability in NodeJS due to improper validation of HTTP requests, allowing a remote attacker to send a potentially malicious request.

How can I fix CVE-2022-35256?