https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-35256.htmlhttps://patchthecve.com/cve/CVE-2022-35256.htmlWed, 17 Jun 2026 04:51:40 +0000MEDIUM 6.5: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.https://patchthecve.com/cve/CVE-2022-32215.htmlhttps://patchthecve.com/cve/CVE-2022-32215.htmlWed, 17 Jun 2026 04:46:53 +0000MEDIUM 6.5: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).https://patchthecve.com/cve/CVE-2022-32214.htmlhttps://patchthecve.com/cve/CVE-2022-32214.htmlWed, 17 Jun 2026 04:46:53 +0000MEDIUM 6.5: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).https://patchthecve.com/cve/CVE-2022-32213.htmlhttps://patchthecve.com/cve/CVE-2022-32213.htmlWed, 17 Jun 2026 04:46:53 +0000MEDIUM 6.5: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).https://patchthecve.com/cve/CVE-2021-22959.htmlhttps://patchthecve.com/cve/CVE-2021-22959.htmlWed, 17 Jun 2026 03:38:06 +0000MEDIUM 6.5: The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.https://patchthecve.com/cve/CVE-2021-22960.htmlhttps://patchthecve.com/cve/CVE-2021-22960.htmlWed, 17 Jun 2026 03:38:06 +0000MEDIUM 6.5: The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.