CVE-2022-32214
Mediumllhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
Published Jul 15, 2022 · Updated Sep 10, 2026 · Also known as ALPINE-CVE-2022-32214, BIT-node-2022-32214, BIT-node-min-2022-32214, DEBIAN-CVE-2022-32214, GHSA-q5vx-44v4-gch4, UBUNTU-CVE-2022-32214
Key Facts
Patch immediately- CVE-2022-32214 is a medium-severity vulnerability (CVSS 6.5 v3.1) affecting Llhttp, Node.js (Nodejs), Stormshield Management Center and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 82% probability of exploitation in the next 30 days.
- Fixed versions are available, including corepack14 14.20.0-150200.15.34.1, corepack16 16.16.0-150400.3.3.2, corepack18 18.13.0-150400.9.3.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
82%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2022-32214 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
Affected Products
497 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| LlhttpLlhttp | See advisory | 2.1.5 |
| Node.jsNodejs | See advisory | 14.14.0 |
| Stormshield Management CenterStormshield | See advisory | 3.3.0 |
| Debian LinuxDebian | 11.0 | n/a |
| nodejsalpine | See advisory | 14.20.1-r0 |
Patched Releases
corepack14
14.20.0-150200.15.34.1
corepack16
16.16.0-150400.3.3.2
corepack18
18.13.0-150400.9.3.1
graalvm22-ce-11
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-devel
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-espresso
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-espresso-llvm
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-fastr
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-javascript
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-jdk
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-libpolyglot
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-llvm
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-llvm-toolchain
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-native-image
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-native-image-llvm-backend
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-nodejs
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-nodejs-devel
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-polyglot
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-python
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-python-devel
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-ruby
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-ruby-devel
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-tools
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-11-wasm
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
graalvm22-ce-17
22.3.0-1.el7, 22.3.0-1.el8, 22.3.0-1.el9
Timeline
Publicly disclosed
Jul 15, 2022
Last updated
Sep 10, 2026
Weakness Type
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
References
- advisoryhttp://access.redhat.com/errata/RHEA-2022:5139
- advisoryhttp://access.redhat.com/errata/RHSA-2022:6463
- advisoryRHSA-2022:6389
- advisoryRHSA-2022:6448
- advisoryRHSA-2022:6449
FAQ
Common Questions.
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.
Affected: Llhttp; Node.js (Nodejs); Stormshield Management Center, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including corepack14 14.20.0-150200.15.34.1, corepack16 16.16.0-150400.3.3.2, corepack18 18.13.0-150400.9.3.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-32214 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo