Node.js.llhttp.Module.Transfer-Encoding.HTTP.Request.Smuggling

description-logoDescription

This indicates an attack attempt to exploit an HTTP Request Smuggling Vulnerability in Node.js.
The vulnerability is due to improper input validation of Transfer-Encoding headers in incoming HTTP requests. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successfully exploiting this vulnerability could result in access to confidential information, passwords and session cookies. In the worst case an attacker could impersonate valid users and gain unrestricted access to the system.

affected-products-logoAffected Products

Node.js Node.js 14.x prior to 14.20.0
Node.js Node.js 16.x prior to 16.16.0
Node.js Node.js 18.x prior to 18.5.0

Impact logoImpact

System Compromise: Remote attackers can gain control of vulnerable systems.

recomended-action-logoRecommended Actions

Apply the most recent upgrade or patch from the vendor.
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

Version Updates

Date Version Detail
2022-12-02 0.00335

CVE References

CVE-2022-32213