HTTP Request Smuggling (HRS) Vulnerability in Node.js
Summary
CVE-2022-32214: The llhttp parser. Affects nodejs across 3 version ranges.
< 14.20.1-r0
>= c1da528bc25c9cc5a8240a7b4f136f5968f6e113, < 50871b58d79c2493df7ed594d543df8a4162f4a4
< f014c23bffb327f3749c6222e96247aec73a1caf
Fixed in 14.20.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications. The llhttp parser in the http module of Node.js is responsible for parsing HTTP requests. However, versions prior to v14.20.1, v16.17.1, and v18.9.1 do not strictly use the CRLF sequence to delimit HTTP requests, which can lead to HTTP Request Smuggling (HRS) attacks.
Vulnerability Detail
The HTTP Request Smuggling (HRS) vulnerability in Node.js allows an attacker to manipulate the parsing of HTTP requests, leading to various security issues. By exploiting this vulnerability, an attacker can bypass security controls, perform cross-site scripting (XSS) attacks, access sensitive information, or execute arbitrary code. This vulnerability arises due to the improper handling of HTTP request delimiters, allowing an attacker to smuggle malicious requests and confuse the parsing process.
How To Fix
Minimum fixed version
14.20.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Node.js is not immediately possible, a temporary workaround is to implement a reverse proxy or web application firewall (WAF) that can detect and block malicious requests. Additionally, developers can manually validate and sanitize HTTP requests to ensure they conform to the expected format.
Conclusion
The HTTP Request Smuggling (HRS) vulnerability in Node.js can have serious security implications, allowing attackers to bypass security controls and perform various attacks. It is crucial to update Node.js to the fixed versions or implement workarounds to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
HTTP Request Smuggling (HRS) is a technique where an attacker manipulates the parsing of HTTP requests to bypass security controls, perform attacks, or access sensitive information.
Exploiting this vulnerability can lead to security bypass, cross-site scripting (XSS) attacks, unauthorized access to sensitive information, or arbitrary code execution.
Versions of Node.js prior to v14.20.1, v16.17.1, and v18.9.1 are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, updating Node.js to version 14.20.1, 16.17.1, or 18.9.1 or later will fix this vulnerability. It is recommended to update to the latest stable version of Node.js.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
