Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-35256

Good to know:

icon

Date: December 5, 2022

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

Language: C

Severity Score

Related Resources (8)

https://nvd.nist.gov/vuln/detail/CVE-2022-35256
https://access.redhat.com/security/cve/CVE-2022-35256
https://security-tracker.debian.org/tracker/CVE-2022-35256
https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
https://hackerone.com/reports/1675191
https://people.canonical.com/~ubuntu-security/cve/CVE-2022-35256
https://www.debian.org/security/2023/dsa-5326
https://www.mend.io/vulnerability-database/CVE-2022-35256

Severity Score

Weakness Type (CWE)

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CWE-444

Top Fix

icon

Upgrade Version

Upgrade to version v14.20.1,v16.17.1,v18.9.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us