CVE:CVE-2022-32213
CNNVD:CNNVD-202207-683
Node.js是一个开源、跨平台的 JavaScript 运行时环境。
Node.js 存在环境问题漏洞，该漏洞源于Node.js http 模块中的 llhttp 解析器未正确解析和验证 Transfer-Encoding 标头，这可能导致 HTTP 请求走私 (HRS)，以下产品和版本受到影响：Node.js 18.x、16.x 和 14.x 版本。
solution:Upgrade llhttp llhttp to a higher version than 2.1.5,6.0.7,and avoid the version (,2.1.5),[6.0.0,6.0.7); Upgrade nodejs node.js to a higher version than 14.14.0,14.20.1,16.12.0,16.17.1,18.9.1,and avoid the version [14.0.0,14.14.0],[14.15.0,14.20.1),[16.0.0,16.12.0],[16.13.0,16.17.1),[18.0.0,18.9.1); Upgrade fedoraproject fedora to a higher version than 35,36,37,and avoid the version 35,36,37; Upgrade siemens sinec_ins to a higher version than 1.0,1.0:sp1,1.0:sp2,and avoid the version 1.0,1.0:sp1,1.0:sp2; Upgrade debian debian_linux to a higher version than 11.0,and avoid the version 11.0; Upgrade stormshield stormshield_management_center to a higher version than 3.3.2,and avoid the version (,3.3.2)