MediumFix available
nodejs — security advisory
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
- Products
- nodejs
- Affected versions
- Not specified
- Fixed versions
- 18.10.0+dfsg-1
- CVEs
- CVE-2022-35256
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:44 UTC · Revision 1
Source evidence
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
osv:DEBIAN-CVE-2022-35256
nodejs
Fixed versions: 18.10.0+dfsg-1
nodejs
Fixed versions: 18.10.0+dfsg-1
nodejs
Fixed versions: 18.10.0+dfsg-1
Complete source record
{
"id": "9aec17f3a0035d240f9eb2140220ecddd99ab71baff93965dc31a161af920931",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-35256",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-35256",
"summary": "The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.",
"evidence": "osv:DEBIAN-CVE-2022-35256",
"products": [
{
"name": {
"value": "nodejs",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "18.10.0+dfsg-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "18.10.0+dfsg-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "18.10.0+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2022-35256",
"aliases": [
"DEBIAN-CVE-2022-35256"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "18.10.0+dfsg-1"
}
]
}
],
"package": {
"name": "nodejs",
"purl": "pkg:deb/debian/nodejs?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-35256.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "18.10.0+dfsg-1"
}
]
}
],
"package": {
"name": "nodejs",
"purl": "pkg:deb/debian/nodejs?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-35256.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "18.10.0+dfsg-1"
}
]
}
],
"package": {
"name": "nodejs",
"purl": "pkg:deb/debian/nodejs?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-35256.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:01:57.298468286Z",
"provider": "osv",
"upstream": [
"CVE-2022-35256"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-35256"
]
},
"related_cves": [
{
"value": "CVE-2022-35256",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 323210,
"published_at": "2022-12-05T22:15:10.57+00:00"
}