CVE-2022-32215

CVE-2022-32215

Vendor Nodejs
Product Node
Weakness CWE-444
Published July 14, 2022
Last update April 30, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

Key dates

02Disclosure timeline

July 14, 2022 CVE published
April 30, 2025 Record updated