HTTP Request Smuggling Vulnerability in Node.js Package
Summary
UBUNTU-CVE-2022-35256: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. Affects nodejs versions < 12.22.9~dfsg-1ubuntu3.2. Fixed in 12.22.9~dfsg-1ubuntu3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine, enabling developers to build scalable network applications. The 'nodejs' package provides the core functionality for running JavaScript on the server side. However, a vulnerability in the llhttp parser of the http module can lead to security issues, particularly in handling HTTP headers.
Vulnerability Detail
The llhttp parser in the http module of Node.js version 18.7.0 does not correctly handle header fields that are not terminated with CRLF (Carriage Return Line Feed). This oversight can lead to HTTP Request Smuggling, where an attacker can manipulate requests sent to a server, potentially allowing unauthorized access or data leakage. The vulnerability is classified with a CVSS score of 6.5, indicating a medium severity level.
How To Fix
Minimum fixed version
12.22.9~dfsg-1ubuntu3.2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement input validation on HTTP headers to ensure they conform to expected formats, thereby reducing the risk of exploitation until the package is updated.
Conclusion
The vulnerability in the llhttp parser of Node.js poses a significant risk of HTTP Request Smuggling. It is crucial to update the 'nodejs' package to the patched version to safeguard your applications. Additionally, utilizing tools like Vulert can help monitor and alert you to open-source vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
HTTP Request Smuggling is a technique used by attackers to send malicious requests to a server, which can lead to unauthorized actions or data exposure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.5, indicating a medium severity level.
No subscription is required to monitor vulnerabilities in the 'nodejs' package; it is available for free.
If you cannot update the package immediately, implement input validation on HTTP headers as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
