CVE-2022-32213: Debian Linux

Medium severity, CVSS 6.5. EPSS: 46% chance of exploitation in the next 30 days.

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Llhttp Llhttp: before 2.1.5 (fixed in 2.1.5); from 6.0.0, before 6.0.7 (fixed in 6.0.7)
• Node.js Node.js: from 14.0.0, up to and including 14.14.0; from 14.15.0, before 14.20.1 (fixed in 14.20.1); from 16.0.0, up to and including 16.12.0; from 16.13.0, before 16.17.1 (fixed in 16.17.1); from 18.0.0, before 18.9.1 (fixed in 18.9.1)
• Siemens Sinec Ins: version 1.0 only
• Stormshield Stormshield Management Center: before 3.3.2 (fixed in 3.3.2)

Published 2022-07-14. Last modified 2026-06-17.