VULNERABILITY INTELLIGENCE

CVE-2022-35256

CVSS score6.5 MEDIUM

EPSS probability2.76%

CISA KEVNot currently listed

Published2022-12-05

Last modified2026-06-17

Description

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.