Search for packages
| purl | pkg:npm/llhttp@1.0.1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-8c4g-fjsa-nkhw
Aliases: CVE-2022-32214 GHSA-q5vx-44v4-gch4 |
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS). |
Affected by 0 other vulnerabilities. |
|
VCID-b54b-pd2b-bygm
Aliases: CVE-2022-32213 GHSA-5689-v88g-g6rv |
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Impacts: - All versions of the nodejs 18.x, 16.x, and 14.x releases lines. - llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js |
Affected by 0 other vulnerabilities. |
|
VCID-dfdy-vhdd-5kh4
Aliases: CVE-2022-35256 |
Multiple vulnerabilities have been discovered in Node.js. | There are no reported fixed by versions. |
|
VCID-gwyr-ac4e-dqfa
Aliases: CVE-2021-22959 |
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') The llhttp parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-tnhd-rr89-9udh
Aliases: CVE-2021-22960 |
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') The parse function in llhttp ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. | There are no reported fixed by versions. |
|
VCID-zstw-3wmu-u3c8
Aliases: CVE-2023-30589 GHSA-cggh-pq45-6h9x |
llhttp vulnerable to HTTP request smuggling The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||