# CVE-2022-32214: llhttp HTTP Request Smuggling via improper header delimiting

Source: https://junglewise.ai/threats/cve-2022-32214-llhttp-http-request-smuggling-via-improper-header-delimiting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-07-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-32214 · Severity: low · CVSS 3.1 · Published 2022-07-15

llhttp is an HTTP parser library used by Node.js to process incoming web requests. Due to improper validation of header field delimiters, attackers can bypass security controls and smuggle malicious requests through proxies and firewalls, potentially leading to cache poisoning, session hijacking, or access to unauthorized backend services.

Technologies: [llhttp (npm)](https://junglewise.ai/threats/technologies/llhttp). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-32214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-32214 being exploited in the wild.

**How severe is CVE-2022-32214?** Low severity, with a CVSS score of 3.1, published 15 July 2022.

**Which products and versions are affected?** llhttp (npm) SEMVER:introduced=0,fixed=6.0.7.

**Is there a fix for CVE-2022-32214?** Yes. llhttp (npm): upgrade to 6.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-32214 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-32214?** Check whether you run llhttp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- llhttp (npm): upgrade to 6.0.7 or later

  ```sh
  npm install llhttp@6.0.7
  ```


## Technical details

The vulnerability is a CWE-444 (HTTP Request Smuggling) issue in llhttp's header parsing logic. The parser incorrectly accepts a lone line feed (LF) character as sufficient to delimit HTTP header fields, whereas RFC 7230 requires a carriage return + line feed (CRLF) sequence. This relaxed parsing allows an attacker to craft malformed HTTP requests that are interpreted differently by llhttp versus downstream HTTP infrastructure, enabling request smuggling attacks. The vulnerability affects all versions prior to 6.0.7 and is exploitable via network access without authentication or user interaction.

## Affected products

- Node.js llhttp before 6.0.7

## Identifiers

- CVE-2022-32214
- GHSA-q5vx-44v4-gch4

## Timeline

- 2022-07-15: disclosed: Advisory published
- 2022-07-06: patched: Fix released in llhttp 6.0.7

## References

- [https://github.com/nodejs/llhttp/commit/18a4afc7ffb4e49dc9e2daebc50588199a6d1dbb](https://github.com/nodejs/llhttp/commit/18a4afc7ffb4e49dc9e2daebc50588199a6d1dbb)

## Related threats

- [llhttp HTTP request smuggling via improper CRLF delimiters](https://junglewise.ai/threats/cve-2023-30589-llhttp-http-request-smuggling-via-improper-crlf-delimiters)
- [llhttp HTTP request smuggling via flawed Transfer-Encoding parsing](https://junglewise.ai/threats/cve-2022-32213-llhttp-http-request-smuggling-via-flawed-transfer-encoding)