CVE-2022-35256
Fixed in a distro release EPSS 3%CVSS 6.5
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs | 1:14.20.1-2.module_el8.7.0+3342+b2df8497 |
| AlmaLinux 8 | nodejs | 1:16.17.1-1.module_el8.6.0+3328+2e4711d7 |
| AlmaLinux 8 | nodejs | 1:18.9.1-1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | nodejs-devel | 1:16.17.1-1.module_el8.6.0+3328+2e4711d7 |
| AlmaLinux 8 | nodejs-devel | 1:18.9.1-1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | nodejs-devel | 1:14.20.1-2.module_el8.7.0+3342+b2df8497 |
| AlmaLinux 8 | nodejs-docs | 1:16.17.1-1.module_el8.6.0+3328+2e4711d7 |
| AlmaLinux 8 | nodejs-docs | 1:14.20.1-2.module_el8.7.0+3342+b2df8497 |
| AlmaLinux 8 | nodejs-docs | 1:18.9.1-1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | nodejs-full-i18n | 1:16.17.1-1.module_el8.6.0+3328+2e4711d7 |
| AlmaLinux 8 | nodejs-full-i18n | 1:14.20.1-2.module_el8.7.0+3342+b2df8497 |
| AlmaLinux 8 | nodejs-full-i18n | 1:18.9.1-1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | nodejs-nodemon | 2.0.19-2.module_el8.6.0+3261+490666b3 |
| AlmaLinux 8 | nodejs-nodemon | 2.0.19-1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | nodejs-packaging | 25-1.module_el8.5.0+2605+45d748af |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | npm | 1:8.19.1-1.18.9.1.1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | npm | 1:6.14.17-1.14.20.1.2.module_el8.7.0+3342+b2df8497 |
| AlmaLinux 8 | npm | 1:8.15.0-1.16.17.1.1.module_el8.6.0+3328+2e4711d7 |
| AlmaLinux 9 | nodejs | 1:16.17.1-1.el9_0 |
| AlmaLinux 9 | nodejs | 1:16.18.1-3.el9_1 |
| AlmaLinux 9 | nodejs-docs | 1:16.17.1-1.el9_0 |
| AlmaLinux 9 | nodejs-docs | 1:16.18.1-3.el9_1 |
| AlmaLinux 9 | nodejs-full-i18n | 1:16.17.1-1.el9_0 |
| AlmaLinux 9 | nodejs-full-i18n | 1:16.18.1-3.el9_1 |
| AlmaLinux 9 | nodejs-libs | 1:16.17.1-1.el9_0 |
| AlmaLinux 9 | nodejs-libs | 1:16.18.1-3.el9_1 |
| AlmaLinux 9 | nodejs-nodemon | 2.0.20-2.el9_1 |
| AlmaLinux 9 | npm | 1:8.19.2-1.16.18.1.3.el9_1 |
| AlmaLinux 9 | npm | 1:8.15.0-1.16.17.1.1.el9_0 |
| Alpine 3.13 | nodejs | 14.20.1-r0 |
| Alpine 3.14 | nodejs | 14.20.1-r0 |
| Alpine 3.15 | nodejs | 16.17.1-r0 |
| Alpine 3.16 | nodejs | 16.17.1-r0 |
| Alpine 3.17 | nodejs | 16.17.1-r0 |
| Alpine 3.18 | nodejs | 16.17.1-r0 |
| Alpine 3.19 | nodejs | 16.17.1-r0 |
| Alpine 3.20 | nodejs | 16.17.1-r0 |
| Alpine 3.21 | nodejs | 16.17.1-r0 |
| Alpine 3.22 | nodejs | 16.17.1-r0 |
| Alpine 3.23 | nodejs | 16.17.1-r0 |
| Alpine 3.24 | nodejs | 16.17.1-r0 |
| Amazon Linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.2 |
| Amazon Linux 2023 | nodejs-devel | 1:18.12.1-1.amzn2023.0.2 |
| Amazon Linux 2023 | nodejs-docs | 1:18.12.1-1.amzn2023.0.2 |
| Amazon Linux 2023 | nodejs-full-i18n | 1:18.12.1-1.amzn2023.0.2 |
| Amazon Linux 2023 | nodejs-libs | 1:18.12.1-1.amzn2023.0.2 |
| Amazon Linux 2023 | npm | 1:8.19.2-1.18.12.1.1.amzn2023.0.2 |
| Amazon Linux 2023 | v8-devel | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 |
| Chainguard | py3-llhttp | 9.3.0.0-r0 |
| Debian 11 | nodejs | 12.22.12~dfsg-1~deb11u3 |
| Debian 12 | nodejs | 18.10.0+dfsg-1 |
| Debian 13 | nodejs | 18.10.0+dfsg-1 |
| Debian 14 | nodejs | 18.10.0+dfsg-1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:14.20.1-2.module+el8.7.0+16991+b0a68a3e |
| Red Hat Enterprise Linux 8 | nodejs | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat Enterprise Linux 8 | nodejs | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:14.20.1-2.module+el8.7.0+16991+b0a68a3e |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:14.20.1-2.module+el8.7.0+16991+b0a68a3e |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:14.20.1-2.module+el8.7.0+16991+b0a68a3e |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:14.20.1-2.module+el8.7.0+16991+b0a68a3e |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:14.20.1-2.module+el8.7.0+16991+b0a68a3e |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:2.0.19-2.module+el8.7.0+16991+b0a68a3e |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:2.0.19-2.module+el8.6.0+16240+7ca51420 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:2.0.19-1.module+el8.7.0+16061+0a247725 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:25-1.module+el8.5.0+10992+fac5fe06 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+15582+19c314fa |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:23-3.module+el8.3.0+6519+9f98ed83 |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.7.0+15582+19c314fa |
| Red Hat Enterprise Linux 8 | npm | 1:8.15.0-1.16.17.1.1.module+el8.6.0+16848+a483195a |
| Red Hat Enterprise Linux 8 | npm | 1:8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b |
| Red Hat Enterprise Linux 8 | npm | 1:6.14.17-1.14.20.1.2.module+el8.7.0+16991+b0a68a3e |
| Red Hat Enterprise Linux 9 | nodejs | 1:16.17.1-1.el9_0 |
| Red Hat Enterprise Linux 9 | nodejs | 1:16.18.1-3.el9_1 |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:16.17.1-1.el9_0 |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:16.18.1-3.el9_1 |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:16.18.1-3.el9_1 |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:16.17.1-1.el9_0 |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:16.17.1-1.el9_0 |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:16.18.1-3.el9_1 |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:16.18.1-3.el9_1 |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:16.17.1-1.el9_0 |
| Red Hat Enterprise Linux 9 | nodejs-libs | 1:16.17.1-1.el9_0 |
| Red Hat Enterprise Linux 9 | nodejs-libs | 1:16.18.1-3.el9_1 |
| Red Hat Enterprise Linux 9 | nodejs-libs-debuginfo | 1:16.18.1-3.el9_1 |
| Red Hat Enterprise Linux 9 | nodejs-libs-debuginfo | 1:16.17.1-1.el9_0 |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:2.0.20-2.el9_1 |
| Red Hat Enterprise Linux 9 | npm | 1:8.15.0-1.16.17.1.1.el9_0 |
| Red Hat Enterprise Linux 9 | npm | 1:8.19.2-1.16.18.1.3.el9_1 |
| Red Hat rhel eus 8.4 | nodejs | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat rhel eus 8.4 | nodejs-debuginfo | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat rhel eus 8.4 | nodejs-debugsource | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat rhel eus 8.4 | nodejs-devel | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat rhel eus 8.4 | nodejs-docs | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat rhel eus 8.4 | nodejs-full-i18n | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat rhel eus 8.4 | nodejs-nodemon | 0:2.0.20-3.module+el8.4.0+18317+43f5ac16 |
| Red Hat rhel eus 8.4 | nodejs-packaging | 0:23-3.module+el8.3.0+6519+9f98ed83 |
| Red Hat rhel eus 8.4 | npm | 1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16 |
| Red Hat rhel eus 8.6 | nodejs | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat rhel eus 8.6 | nodejs-debuginfo | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat rhel eus 8.6 | nodejs-debugsource | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat rhel eus 8.6 | nodejs-devel | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat rhel eus 8.6 | nodejs-docs | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat rhel eus 8.6 | nodejs-full-i18n | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat rhel eus 8.6 | nodejs-nodemon | 0:2.0.20-3.module+el8.6.0+18532+cbe6f646 |
| Red Hat rhel eus 8.6 | nodejs-packaging | 0:23-3.module+el8.3.0+6519+9f98ed83 |
| Red Hat rhel eus 8.6 | npm | 1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646 |
| Red Hat rhel software collections 3 | rh-nodejs14-nodejs | 0:14.20.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs14-nodejs-debuginfo | 0:14.20.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs14-nodejs-devel | 0:14.20.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs14-nodejs-docs | 0:14.20.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs14-npm | 0:6.14.17-14.20.1.2.el7 |
| Rocky Linux 8 | nodejs | 1:14.20.1-2.module+el8.7.0+1071+4bdda2a8 |
| Rocky Linux 8 | nodejs | 1:18.9.1-1.module+el8.7.0+1072+5b168780 |
| Rocky Linux 8 | nodejs | 1:16.17.1-1.module+el8.6.0+1046+80feca58 |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.19-2.module+el8.6.0+1003+ae94235a |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.19-2.module+el8.6.0+1046+80feca58 |
| Rocky Linux 8 | nodejs-nodemon | 0:2.0.19-1.module+el8.7.0+1072+5b168780 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
| Rocky Linux 8 | nodejs-packaging | 0:23-3.module+el8.7.0+1071+4bdda2a8 |
| Rocky Linux 8 | nodejs-packaging | 0:23-3.module+el8.3.0+100+234774f7 |
| Rocky Linux 8 | nodejs-packaging | 0:25-1.module+el8.5.0+702+221f14e6 |
| Rocky Linux 8 | nodejs-packaging | 0:23-3.module+el8.5.0+733+de4fee6c |
| Rocky Linux 8 | nodejs-packaging | 0:25-1.module+el8.6.0+1046+80feca58 |
| Rocky Linux 9 | nodejs | 1:16.17.1-1.el9_0 |
| Rocky Linux 9 | nodejs | 1:16.18.1-3.el9_1 |
| Rocky Linux 9 | nodejs-nodemon | 0:2.0.20-2.el9_1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs12 | 12.22.12-1.54.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs14 | 14.20.1-6.34.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs16 | 16.17.1-8.12.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs18 | 18.13.0-8.3.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP3 | nodejs12 | 12.22.12-150200.4.38.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP3 | nodejs14 | 14.20.1-150200.15.37.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP3 | nodejs16 | 16.17.1-150300.7.12.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP4 | nodejs16 | 16.17.1-150400.3.9.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP4 | nodejs18 | 18.13.0-150400.9.3.1 |
| Ubuntu 20.04 LTS | nodejs | 10.19.0~dfsg-3ubuntu1.3 |
| Ubuntu 22.04 LTS | nodejs | 12.22.9~dfsg-1ubuntu3.2 |
| Ubuntu Pro 18.04 LTS | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm4 |
| Wolfi | py3-llhttp | 9.3.0.0-r0 |
| openSUSE Leap 15.3 | nodejs10 | 10.24.1-150000.1.50.1 |
| openSUSE Leap 15.3 | nodejs12 | 12.22.12-150200.4.38.1 |
| openSUSE Leap 15.3 | nodejs14 | 14.20.1-150200.15.37.1 |
| openSUSE Leap 15.3 | nodejs16 | 16.17.1-150300.7.12.1 |
| openSUSE Leap 15.4 | nodejs10 | 10.24.1-150000.1.50.1 |
| openSUSE Leap 15.4 | nodejs12 | 12.22.12-150200.4.38.1 |
| openSUSE Leap 15.4 | nodejs14 | 14.20.1-150200.15.37.1 |
| openSUSE Leap 15.4 | nodejs16 | 16.17.1-150400.3.9.1 |
| openSUSE Leap 15.4 | nodejs18 | 18.13.0-150400.9.3.1 |
| openSUSE Leap 15.5 | nodejs18 | 18.13.0-150400.9.3.1 |
| openSUSE Tumbleweed | nodejs16 | 16.17.1-1.1 |
| openSUSE Tumbleweed | nodejs18 | 18.10.0-1.1 |