BIT-node-2022-35256

vendorUSosv

view advisory published 2024-03-06Licence: per source

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-35256US	medium6.5	2.76% (86th)	—	2022-12-05
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

references

External citations — patches, advisories, analysis.

https://hackerone.com/reports/1675191ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-35256WEB
https://www.debian.org/security/2023/dsa-5326ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan