CVE-2022-32214: Debian Linux

Medium severity, CVSS 6.5. EPSS: 81.8% chance of exploitation in the next 30 days.

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

Affected products

• Debian Debian Linux: version 11.0 only
• Llhttp Llhttp: before 2.1.5 (fixed in 2.1.5); from 6.0.0, before 6.0.7 (fixed in 6.0.7)
• Node.js Node.js: from 14.0.0, up to and including 14.14.0; from 14.15.0, before 14.20.0 (fixed in 14.20.0); from 16.0.0, up to and including 16.12.0; from 16.13.0, before 16.16.0 (fixed in 16.16.0); from 18.0.0, before 18.5.0 (fixed in 18.5.0)
• Stormshield Stormshield Management Center: before 3.3.0 (fixed in 3.3.0)

Published 2022-07-14. Last modified 2026-06-17.