Login Request a demo
LL
Product
Llhttp
by Llhttp · last CVE Dec 5, 2022
6
CVEs
0
On KEV
6.5
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 0High 0Medium 6Low 0
Severity
All severities6Critical0High0Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Llhttp to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-35256
6.5
3%
Dec 5
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF
Affected: before 6.0.10
CVE-2022-32215
6.5
70%
Jul 14
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers
Affected: 14.0.0 before 14.20.1; 16.0.0 before 16.17.1; 18.0.0 before 18.9.1
CVE-2022-32214
6.5
82%
Jul 14
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests
Affected: before 2.1.5; 6.0.0 before 6.0.7
CVE-2022-32213
6.5
45%
Jul 14
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request…
Affected: before 2.1.5; 6.0.0 before 6.0.7
CVE-2021-22959
6.5
3%
Nov 15
The parser in accepts requests with a space (SP) right after the header name before the colon
Affected: before 2.1.4; 3.0.0 before 6.0.6
CVE-2021-22960
6.5
2%
Nov 3
The parse function in llhttp < 2.1.4 and < 6.0.6
Affected: before 2.1.4; 3.0.0 before 6.0.6
Showing 6