CVE-2022-32213: debian debian_linux
Vulnerability summary
CVE-2022-32213 is a medium (CVSS 6.5) vulnerability in debian debian_linux. EPSS estimates a 44.84% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 30 · Related 24Timeline
- 14-07-2022PublishedVulnerability first disclosed.
- 30-04-2025Last modifiedVulnerability information updated.
Description
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVSS metrics
7 scores · 7 sources · 1 version- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · NpmEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
44.84%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
Decrease -1.11 pp
From 45.96% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine2 products
- nodejs< 14.20.1-r0 | < 16.17.1-r0
- nodejs-current< 18.9.1-r0
Debian2 products
- nodejs< 18.6.0+dfsg-3
- debian_linuxEOL11.0
Nodejs2 products
- node≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.20.1 | ≥ 15.0, < 15.* | ≥ 16.0, < 16.17.1 | ≥ 17.0, < 17.* | ≥ 18.0, < 18.9.1
- node.js≥ 14.0.0, ≤ 14.14.0 | ≥ 14.15.0, < 14.20.1 | ≥ 16.0.0, ≤ 16.12.0 | ≥ 16.13.0, < 16.17.1 | ≥ 18.0.0, < 18.9.1
Chainguard1 product
- ruby3.2-llhttpAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL35 | 36 | 37
Llhttp1 product
- llhttp< 2.1.5 | ≥ 6.0.0, < 6.0.7
Npm1 product
- llhttp< 6.0.7
Siemens1 product
- sinec_ins1.0 | 1.0:sp1 | 1.0:sp2
Stormshield1 product
Ubuntu1 product
- nodejs< 12.22.9~dfsg-1ubuntu3.2
Wolfi1 product
- ruby3.2-llhttpAll versions (No fix recorded)
11 vendors · 14 products
References
22 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
