CVE-2022-35256

PoC —

CVSS 3.1

6.5 medium

EPSS

3%p84

Published

Dec 5, 2022 (Dec 5, 2022)

Modified

Jun 17, 2026

Description

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

Vendors: nodejs llhttp siemens debian
Products: node.js, llhttp, sinec ins, debian linux
Weakness: CWE-444
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (2.6%)

In the news3 stories

CISA Warns of Flaws in Siemens, GE Digital, and Contec Industrial Control Systems

The Hacker NewsJan 18, 06:14 UTC · Jan 18, 2023Advisory CVE-2022-45092 CVE-2022-2068 CVE-2022-35256+3 CVEs

Week in review: 7 cybersecurity audiobooks to read, Patch Tuesday forecast

Help Net SecurityOct 9, 00:00 UTC · Oct 9, 2022Vulnerability in the wildCVE-2022-41040 CVE-2022-41082 CVE-2022-35256

HTTP request smuggling vulnerability in Node.js (CVE-2022-35256)

Help Net SecurityJun 2, 12:29 UTC · Jun 2, 2023Vulnerability CVE-2022-35256