Skip to content
OpenAdvisories

Package · npm

llhttp

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2023-30589

    llhttp vulnerable to HTTP request smuggling

    The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…

    nodejs node openjdk17 nodejs Debian Alpine npm
  • Critical 9.1
    CVE-2022-32214 EPSS 82%

    llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

    nodejs node nodejs nodejs Debian Ubuntu Alpine npm
  • Critical 9.1
    CVE-2022-32213 EPSS 45%

    llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

    The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

    nodejs node nodejs nodejs Debian Ubuntu Alpine npm