Vendors / Llhttp Records 6 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 0
Exploited now Llhttp records in CISA KEV No Llhttp vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 69
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.
CVSS 3.1 MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.81832 · Published 2022-07-14 · Fixed in 14.20.0, 16.20.0 +2 CWE-444
Priority HIGH 68
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.
CVSS 3.1 MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02764 · Published 2022-12-05 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority HIGH 66
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers.
CVSS 3.1 MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.70244 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority MEDIUM 58
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVSS 3.1 MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.44843 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +2 CWE-444
Priority LOW 35
The parser in accepts requests with a space (SP) right after the header name before the colon.
CVSS 3.1 MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.03156 · Published 2021-11-15 · Partial fix · 12.22.7, 14.18.1 +1 CWE-444
Priority LOW 34
The parse function in llhttp < 2.1.4 and < 6.0.6.
CVSS 3.1 MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02472 · Published 2021-11-03 · Partial fix · 12.22.7, 14.18.1 +1 CWE-444
Open these records in search → All records by CVSS severity
0 0 6 0 0
THREATIST.IORead the docs