CVE-2022-32213

Node.js versions before 14.20.1, 16.17.1, and 18.9.1 have a flaw in how they parse Transfer-Encoding headers in HTTP requests, allowing attackers to sneak malicious requests past security filters by exploiting this parsing mistake.

The llhttp parser in Node.js's http module fails to correctly parse and validate Transfer-Encoding headers, enabling HTTP Request Smuggling attacks. An attacker can craft specially formed requests with ambiguous Transfer-Encoding values to bypass request filtering, potentially allowing unauthorized access to backend services or cache poisoning. The vulnerability affects versions below 14.20.1, 16.17.1, and 18.9.1.