CVE-2022-32215: Node.js llhttp parser mishandles multi-line Transfer-Encoding headers, enabling request smuggling

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRequest smuggling can bypass security controls and poison caches, and the very high EPSS score plus an exploit-tagged reference indicate active interest despite the medium CVSS score.

What it is

The llhttp parser in Node.js versions before 14.20.1, 16.17.1 and 18.9.1 does not correctly handle multi-line Transfer-Encoding headers. This parsing inconsistency allows HTTP Request Smuggling, where a front-end and back-end server disagree on request boundaries. Because Node.js is widely embedded in proxies, APIs and services, the flaw matters wherever Node.js sits behind or in front of another HTTP intermediary.

Impact

An attacker can smuggle a second request past front-end controls, potentially poisoning caches, bypassing access controls, or reaching internal endpoints. The CVSS vector shows only low confidentiality and integrity impact, so the practical gain depends on the surrounding architecture.

Attack surface

Reachable over the network via crafted HTTP requests to a Node.js-based HTTP endpoint or any intermediary using the affected llhttp parser. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.688 (99.3rd percentile), and a HackerOne report is tagged as an exploit reference. No ransomware usage is documented.

What to do

• Upgrade Node.js to 14.20.1, 16.17.1, 18.9.1 or later, and update bundled llhttp in any embedded or vendored copies.
• Apply vendor patches for downstream products (Siemens SINEC INS, Debian, Fedora, Stormshield) that ship the affected parser.
• Normalize or reject ambiguous multi-line Transfer-Encoding headers at the edge and ensure front-end and back-end servers use consistent HTTP parsing.
• Disable or avoid request smuggling-prone connection reuse between mismatched front-end and back-end HTTP stacks where feasible.

Detection

• Inspect HTTP traffic for multi-line or duplicated Transfer-Encoding headers and conflicting Content-Length/Transfer-Encoding combinations.
• Compare how front-end and back-end servers parse the same request and alert on boundary disagreements or unexpected pipelined requests.
• Monitor for anomalous request patterns such as smuggled prefixes, cache poisoning indicators, or unexpected internal endpoint access.
• Track Node.js and llhttp versions in inventory to find unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.