Search for packages
| purl | pkg:deb/debian/nodejs@18.6.0%2Bdfsg-3?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-7tpb-9zrz-e7e1 | Multiple vulnerabilities have been discovered in Node.js. |
CVE-2022-32212
|
| VCID-8c4g-fjsa-nkhw | llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS). |
CVE-2022-32214
GHSA-q5vx-44v4-gch4 |
| VCID-b54b-pd2b-bygm | llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Impacts: - All versions of the nodejs 18.x, 16.x, and 14.x releases lines. - llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js |
CVE-2022-32213
GHSA-5689-v88g-g6rv |
| VCID-wzcw-dd7m-zkaz | Multiple vulnerabilities have been discovered in Node.js. |
CVE-2022-32215
|