HTTP Request Smuggling Vulnerability in Node.js
Summary
CVE-2022-32215: The llhttp parser. Affects nodejs across 2 version ranges.
< 14.20.1-r0
>= 73aa21658dfa6a22c06451d080152b32b1f98dbe, < c11b8215bd6388854efcc9302a7383c8c63b8127
Fixed in 14.20.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications. The HTTP module in Node.js provides functionality for creating HTTP servers and making HTTP requests. However, versions of Node.js prior to v14.20.1, v16.17.1, and v18.9.1 are vulnerable to an HTTP Request Smuggling (HRS) attack.
Vulnerability Detail
The llhttp parser in the http module of Node.js does not correctly handle multi-line Transfer-Encoding headers. This vulnerability can be exploited by an attacker to perform HTTP Request Smuggling attacks. By manipulating the Transfer-Encoding header, an attacker can trick the server into interpreting the request differently, leading to potential security issues such as bypassing security controls or accessing unauthorized resources.
How To Fix
Minimum fixed version
14.20.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Node.js is not immediately possible, a temporary workaround is to use a reverse proxy or a web application firewall (WAF) that can handle multi-line Transfer-Encoding headers correctly. This can help mitigate the risk of HTTP Request Smuggling attacks.
Conclusion
The HTTP Request Smuggling vulnerability in Node.js versions prior to v14.20.1, v16.17.1, and v18.9.1 can lead to security issues and potential exploitation. It is crucial to update Node.js to the fixed versions or apply the recommended workarounds to mitigate the risk. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
HTTP Request Smuggling (HRS) is a technique where an attacker manipulates the HTTP request to bypass security controls or access unauthorized resources. It involves exploiting inconsistencies in how different components interpret and handle HTTP requests.
To mitigate HTTP Request Smuggling, it is important to ensure that all components involved in processing HTTP requests, including web servers, reverse proxies, and application frameworks, handle headers correctly and consistently. Regularly updating software and applying security patches is also crucial.
HTTP Request Smuggling can have severe consequences, including bypassing security controls, accessing unauthorized resources, and performing various types of attacks such as privilege escalation, data leakage, or remote code execution.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to promptly update Node.js to the fixed versions to prevent potential exploitation.
For more information about this vulnerability, you can refer to the CVE-2022-32215 entry in the National Vulnerability Database (NVD) or the provided database-specific source link.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
