Search for packages
| purl | pkg:rpm/redhat/nodejs@1:16.16.0-1?arch=el9_0 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-7tpb-9zrz-e7e1
Aliases: CVE-2022-32212 |
Multiple vulnerabilities have been discovered in Node.js. | There are no reported fixed by versions. |
|
VCID-8c4g-fjsa-nkhw
Aliases: CVE-2022-32214 GHSA-q5vx-44v4-gch4 |
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. The LF character (without CR) is sufficient to delimit HTTP header fields in the lihttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This can lead to HTTP Request Smuggling (HRS). | There are no reported fixed by versions. |
|
VCID-b54b-pd2b-bygm
Aliases: CVE-2022-32213 GHSA-5689-v88g-g6rv |
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Impacts: - All versions of the nodejs 18.x, 16.x, and 14.x releases lines. - llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js | There are no reported fixed by versions. |
|
VCID-wzcw-dd7m-zkaz
Aliases: CVE-2022-32215 |
Multiple vulnerabilities have been discovered in Node.js. | There are no reported fixed by versions. |
|
VCID-x6cv-wu7q-nqa6
Aliases: CVE-2022-29244 GHSA-hj9c-8jmm-8c52 GMS-2022-1719 |
Packing does not respect root-level ignore files in workspaces ### Impact `npm pack` ignores root-level `.gitignore` & `.npmignore` file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` with workspaces, as of [v7.9.0](https://github.com/npm/cli/releases/tag/v7.9.0) & [v7.13.0](https://github.com/npm/cli/releases/tag/v7.13.0) respectively, may be affected and have published files into the npm registry they did not intend to include. ### Patch - Upgrade to the latest, patched version of `npm` ([`v8.11.0`](https://github.com/npm/cli/releases/tag/v8.11.0) or greater), run: `npm i -g npm@latest` - Node.js versions [`v16.15.1`](https://github.com/nodejs/node/releases/tag/v16.15.1), [`v17.19.1`](https://github.com/nodejs/node/releases/tag/v17.9.1) & [`v18.3.0`](https://github.com/nodejs/node/releases/tag/v18.3.0) include the patched `v8.11.0` version of `npm` #### Steps to take to see if you're impacted 1. Run `npm publish --dry-run` or `npm pack` with an `npm` version `>=7.9.0` & `<8.11.0` inside the project's root directory using a workspace flag like: `--workspaces` or `--workspace=<name>` (ex. `npm pack --workspace=foo`) 2. Check the output in your terminal which will list the package contents (note: `tar -tvf <package-on-disk>` also works) 3. If you find that there are files included you did not expect, you should: 3.1. Create & publish a new release excluding those files (ref. ["Keeping files out of your Package"](https://docs.npmjs.com/cli/v8/using-npm/developers#keeping-files-out-of-your-package)) 3.2. Deprecate the old package (ex. `npm deprecate <pkg>[@<version>] <message>`) 3.3. Revoke or rotate any sensitive information (ex. passwords, tokens, secrets etc.) which might have been exposed ### References - [CVE-2022-29244](https://nvd.nist.gov/vuln/detail/CVE-2022-29244) - [`npm-packlist`](https://github.com/npm/npm-packlist) - [`libnpmpack`](https://github.com/npm/cli/tree/latest/workspaces/libnpmpack) - [`libnpmpublish`](https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish) | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T13:58:11.754766+00:00 | RedHat Importer | Affected by | VCID-x6cv-wu7q-nqa6 | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29244.json | 38.0.0 |
| 2026-04-01T13:58:01.519554+00:00 | RedHat Importer | Affected by | VCID-b54b-pd2b-bygm | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-32213.json | 38.0.0 |
| 2026-04-01T13:58:01.463193+00:00 | RedHat Importer | Affected by | VCID-8c4g-fjsa-nkhw | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-32214.json | 38.0.0 |
| 2026-04-01T13:58:01.408196+00:00 | RedHat Importer | Affected by | VCID-wzcw-dd7m-zkaz | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-32215.json | 38.0.0 |
| 2026-04-01T13:58:01.339690+00:00 | RedHat Importer | Affected by | VCID-7tpb-9zrz-e7e1 | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-32212.json | 38.0.0 |