PatchTheCVEllhttp vulnerabilities
Recent CVEs affecting llhttp products. 6 tracked.
llhttp has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2022-12-05. Highest priority: CVE-2022-32215 (score 63/100).
- CVE-2022-35256 MEDIUM 6.5 UPGRADE UPGRADE The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not term
- CVE-2022-32215 MEDIUM 6.5 UPGRADE UPGRADE The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle mu
- CVE-2022-32214 MEDIUM 6.5 UPGRADE UPGRADE The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CR
- CVE-2022-32213 MEDIUM 6.5 UPGRADE UPGRADE The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and
- CVE-2021-22960 MEDIUM 6.5 UPGRADE DOWNGRADE The parse function in llhttp < 2.1.4 and < 6.0.6
- CVE-2021-22959 MEDIUM 6.5 UPGRADE DOWNGRADE The parser in accepts requests with a space (SP) right after the header name before the colon
FAQ
How do I fix llhttp vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is llhttp being exploited right now?
None of the tracked llhttp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which llhttp CVE should I patch first?
CVE-2022-32215 currently ranks highest (63/100): The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle mu.