Read the docs
TI-2021-05820 Aliases CVE-2021-22959GHSA-mhxq-vjjq-pcvf

The parser in accepts requests with a space (SP) right after the header name before the…

Priority LOW 35CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 6 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.

Why it matters now

EPSS 0.03156 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Node (NodeJS): 12.22.7, 14.18.1, 16.11.1Red Hat: 5 advisoriesRed Hat: 6 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSNode4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 to before 12.22.7; 13.0 and later; 14.0 to before 14.18.1; 15.0 and later; 16.0 to before 16.11.112.22.7, 14.18.1, 16.11.1Patch availableCNA
  • Node VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 to before 12.22.7; 13.0 and later; 14.0 to before 14.18.1; 15.0 and later; 16.0 to before 16.11.1 Fixed in 12.22.7, 14.18.1, 16.11.1 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*before 2.1.4; 3.0.0 to before 6.0.6VulnerableLlhttp
cpe:2.3:a:oracle:graalvm:20.3.4:*:*:*:enterprise:*:*:*20.3.4VulnerableOracle
cpe:2.3:a:oracle:graalvm:21.3.0:*:*:*:enterprise:*:*:*21.3.0VulnerableOracle
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:* Versions before 2.1.4; 3.0.0 to before 6.0.6 Vulnerable ·Llhttp
  • cpe:2.3:a:oracle:graalvm:20.3.4:*:*:*:enterprise:*:*:* Versions 20.3.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:graalvm:21.3.0:*:*:*:enterprise:*:*:* Versions 21.3.0 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA Node (NodeJS) Fixed in 12.22.7, 14.18.1, 16.11.1

Red Hat 5 advisories

  • RHSA-2022:4914 Released 2022-06-06 · Red Hat rating Moderate
    rh-nodejs12-nodejs security, bug fix, and enhancement update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs12-nodejs-12.22.12-2.el7, rh-nodejs12-nodejs-devel-12.22.12-2.el7, rh-nodejs12-nodejs-docs-12.22.12-2.el7 +1
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs12-nodejs-12.22.12-2.el7, rh-nodejs12-nodejs-devel-12.22.12-2.el7, rh-nodejs12-nodejs-docs-12.22.12-2.el7 +1
  • RHSA-2022:0350 Released 2022-02-01 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.aarch64::nodejs:14, nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.ppc64le::nodejs:14, nodejs-1:14.18.2-2.module+el8.5.0+13644+8d46dafd.s390x::nodejs:14 +19
  • RHSA-2022:0246 Released 2022-01-25 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.aarch64::nodejs:14, nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.ppc64le::nodejs:14, nodejs-1:14.18.2-2.module+el8.4.0+13643+6c0ebf22.s390x::nodejs:14 +19
Show 2 more Red Hat advisories
  • RHSA-2022:0041 Released 2022-01-06 · Red Hat rating Moderate
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.18.2-1.el7, rh-nodejs14-nodejs-devel-14.18.2-1.el7, rh-nodejs14-nodejs-docs-14.18.2-1.el7 +2
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.18.2-1.el7, rh-nodejs14-nodejs-devel-14.18.2-1.el7, rh-nodejs14-nodejs-docs-14.18.2-1.el7 +2
  • RHSA-2021:5171 Released 2021-12-16 · Red Hat rating Moderate
    nodejs:16 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.aarch64::nodejs:16, nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.ppc64le::nodejs:16, nodejs-1:16.13.1-3.module+el8.5.0+13548+45d748af.s390x::nodejs:16 +19

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:5171, RHSA-2022:0350
Red Hat Enterprise Linux AppStream E4S (v. 8.1)Fixed—
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed—
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2022:0246
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2022:0041, RHSA-2022:4914
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2022:0041, RHSA-2022:4914
Not affected: 1 product
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22959
  2. 2026-10-03 Alias added: GHSA-mhxq-vjjq-pcvf

References

Exploit 1

Patch 1

Advisory 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-18584 Race condition in NodeJS Node CVSS 3.0HIGH 8.2
  • TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
See all 295 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences