Llhttp
llhttp
6 CVEs • 1 product
Products (1)
Click to collapseToggle
Products (1)
Click to collapse
CVEs (6)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
4Debian LlhttpNodejs+1 more4Debian Linux LlhttpNode.js+1 moreJun 17, 2026 Dec 5, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. |
6Debian FedoraprojectLlhttp+3 more6Debian Linux FedoraLlhttp+3 moreJun 17, 2026 Jul 14, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). |
4Debian LlhttpNodejs+1 more4Debian Linux LlhttpNode.js+1 moreJun 17, 2026 Jul 14, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). |
6Debian FedoraprojectLlhttp+3 more6Debian Linux FedoraLlhttp+3 moreJun 17, 2026 Jul 14, 2022 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). |
3Debian LlhttpOracle3Debian Linux GraalvmLlhttpJun 17, 2026 Nov 15, 2021 N/A· v4 6.5 MEDIUM· v3 6.4 MEDIUM· v2 The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. |
3Debian LlhttpOracle3Debian Linux GraalvmLlhttpJun 17, 2026 Nov 3, 2021 N/A· v4 6.5 MEDIUM· v3 5.8 MEDIUM· v2 The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. |