Junglewise Threat Intelligence

CVE-2022-32213: llhttp HTTP request smuggling via flawed Transfer-Encoding parsing

CVE-2022-32213 · Severity: low · CVSS 3.1 · Published 2022-07-15

Technologies: Nodejs Node.Js, llhttp (npm). Vendors: Nodejs, npm.

Executive brief

llhttp is an HTTP parser used by Node.js to process incoming web requests. A flaw in how it parses the Transfer-Encoding header allows attackers to send specially crafted HTTP requests that bypass security checks and smuggle malicious payloads through proxies and firewalls. This can lead to cache poisoning, credential theft, or unauthorized access to backend systems.

Technical details

The vulnerability is an HTTP request smuggling (CWE-444) flaw in the llhttp parser's handling of Transfer-Encoding headers. The parser does not correctly validate and parse Transfer-Encoding header values, allowing attackers to craft requests that are interpreted differently by the HTTP parser and downstream servers. An attacker can send a network-based HTTP request with a malformed Transfer-Encoding header; no authentication or user interaction is required. Successful exploitation enables HTTP request smuggling attacks, which can result in cache poisoning, session fixation, credential theft, or server-side request forgery depending on downstream application logic. Patches are available in llhttp v6.0.7 and v2.1.5, which were backported into Node.js versions 18.x, 16.x, and 14.x.

Affected products

  • nodejs llhttp before 6.0.7 and before 2.1.5
  • nodejs Node.js 14.x, 16.x, 18.x (affected until patched)

Timeline

  • 2022-07-15: disclosed: Vulnerability publicly disclosed via GHSA-5689-v88g-g6rv
  • 2022-07-06: patched: llhttp v6.0.7 released with fix
  • 2022-07: other: Node.js security releases for affected versions (14.x, 16.x, 18.x)

References

Related threats