Approved changes feed: RSS · Atom
cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*part: a version: * update: *
| Vendor | Llhttp (a4116bd9-b445-52df-9895-3254ff777deb) |
|---|---|
| Product | Llhttp (8a1a6219-d4a7-5f00-a526-1901076467cb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/nodejs/llhttp |
purl2cpe | 2026-06-01 10:17:47.536916 |
pkg:npm/llhttp |
purl2cpe | 2026-06-01 10:17:47.536918 |
pkg:rpm/fedora/llhttp |
purl2cpe | 2026-06-01 10:17:47.536919 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-35256 |
vulnerable | 2026-06-08 05:46:04.430369 |
Details available
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
Published: 2022-12-05T00:00:00.000Z
Updated: 2025-04-30T22:24:47.709Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-32215 |
vulnerable | 2026-06-08 05:44:42.746851 |
Details available
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
Published: 2022-07-14T00:00:00.000Z
Updated: 2025-04-30T22:24:42.485Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-32214 |
vulnerable | 2026-06-08 05:44:42.745938 |
Details available
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
Published: 2022-07-14T00:00:00.000Z
Updated: 2025-04-30T22:24:43.342Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-32213 |
vulnerable | 2026-06-08 05:44:42.741126 |
Details available
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
Published: 2022-07-14T00:00:00.000Z
Updated: 2025-04-30T22:24:45.103Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22960 |
vulnerable | 2026-06-08 05:30:02.027208 |
Details available
The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
Published: 2021-11-03T19:22:42.000Z
Updated: 2025-04-30T22:24:38.152Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-22959 |
vulnerable | 2026-06-08 05:30:02.025074 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.