HTTP Request Smuggling Vulnerability in Node.js
Summary
CVE-2022-32213: The llhttp parser. Affects nodejs across 3 version ranges.
< 14.20.1-r0
>= c1da528bc25c9cc5a8240a7b4f136f5968f6e113, < c11b8215bd6388854efcc9302a7383c8c63b8127
< f014c23bffb327f3749c6222e96247aec73a1caf
Fixed in 14.20.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance network applications. The llhttp parser in the http module of Node.js is responsible for parsing and validating HTTP requests. However, versions prior to v14.20.1, v16.17.1, and v18.9.1 have a vulnerability that can lead to HTTP Request Smuggling (HRS).
Vulnerability Detail
The llhttp parser in the http module of Node.js does not correctly parse and validate Transfer-Encoding headers. This can be exploited by an attacker to perform HTTP Request Smuggling attacks. HTTP Request Smuggling occurs when an attacker can bypass security measures by manipulating the interpretation of HTTP requests. This can lead to various security issues, such as bypassing access controls, injecting malicious content, or performing cross-site scripting attacks.
How To Fix
Minimum fixed version
14.20.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Node.js to the fixed versions as soon as possible.
Conclusion
The HTTP Request Smuggling vulnerability in Node.js can have serious security implications. It is crucial to update Node.js to the fixed versions to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance network applications.
HTTP Request Smuggling is a technique where an attacker can manipulate the interpretation of HTTP requests to bypass security measures or perform malicious actions.
This vulnerability can be exploited by sending specially crafted HTTP requests with manipulated Transfer-Encoding headers to the vulnerable Node.js server.
The consequences of this vulnerability include bypassing access controls, injecting malicious content, and performing cross-site scripting attacks.
Yes, updating Node.js to version 14.20.1, 16.17.1, or 18.9.1 or later will fix this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
