HTTP Request Smuggling in Node.js
Summary
CVE-2022-35256: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. Affects nodejs across 3 version ranges.
< 07cf037a904240a3a095d796f6e61ed2f563a8fb
< 14.20.1-r0
>= c1da528bc25c9cc5a8240a7b4f136f5968f6e113, < c11b8215bd6388854efcc9302a7383c8c63b8127
Fixed in 14.20.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications using event-driven, non-blocking I/O. The llhttp parser in the http module of Node.js is responsible for parsing HTTP requests and responses. However, a vulnerability in this parser allows for HTTP Request Smuggling attacks.
Vulnerability Detail
The llhttp parser in the http module of Node.js does not correctly handle header fields that are not terminated with CLRF (Carriage Return Line Feed). This can lead to HTTP Request Smuggling, a technique where an attacker can manipulate the parsing of HTTP requests to bypass security measures or perform malicious actions. By exploiting this vulnerability, an attacker can potentially perform various attacks, such as cache poisoning, session hijacking, or cross-site scripting (XSS). The severity of this vulnerability is moderate, with a CVSS score of 6.5.
How To Fix
Minimum fixed version
14.20.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to update Node.js to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The llhttp parser vulnerability in Node.js can lead to HTTP Request Smuggling attacks, potentially compromising the security of applications. To mitigate this vulnerability, it is crucial to update Node.js to the fixed versions mentioned in the 'how_to_fix' section. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
HTTP Request Smuggling is a technique where an attacker manipulates the parsing of HTTP requests to bypass security measures or perform malicious actions. It can lead to various attacks, such as cache poisoning, session hijacking, or cross-site scripting (XSS).
This vulnerability allows an attacker to perform HTTP Request Smuggling attacks, potentially leading to security bypass, cache poisoning, session hijacking, or cross-site scripting (XSS) attacks.
To mitigate the risk of this vulnerability, it is recommended to update Node.js to the fixed versions mentioned in the 'how_to_fix' section.
There are no known exploits for this vulnerability at the moment. However, it is important to update Node.js to the fixed versions to prevent potential exploitation.
You can find more information about this vulnerability in the CVE-2022-35256 JSON file available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-35256.json
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
