CVE-2022-32215: Debian Linux

Medium severity, CVSS 6.5. EPSS: 70.2% chance of exploitation in the next 30 days.

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

Affected products

• Debian Debian Linux: version 11.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Llhttp Llhttp: from 14.0.0, before 14.20.1 (fixed in 14.20.1); from 16.0.0, before 16.17.1 (fixed in 16.17.1); from 18.0.0, before 18.9.1 (fixed in 18.9.1)
• Node.js Node.js: from 14.0.0, up to and including 14.14.0; from 14.15.0, before 14.20.0 (fixed in 14.20.0); from 16.0.0, up to and including 16.12.0; from 16.13.0, before 16.16.0 (fixed in 16.16.0); from 18.0.0, before 18.5.0 (fixed in 18.5.0)
• Siemens Sinec Ins: version 1.0 only
• Stormshield Stormshield Management Center: before 3.3.2 (fixed in 3.3.2)

Published 2022-07-14. Last modified 2026-06-17.