npm llhttp vulnerabilities

Latest npm llhttp CVEs

Newest publication first

1. CVE-2023-30589 llhttp vulnerable to HTTP request smuggling

   Published 2023-06-30

   High·CVSS 7.5 EPSS 3.9%

   The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC72...

2. CVE-2022-32214 llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

   Published 2022-07-14

   Medium·CVSS 6.5 EPSS 81.8%

   The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

3. CVE-2022-32213 llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

   Published 2022-07-14

   Medium·CVSS 6.5 EPSS 44.8%

   The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.