CVE-2022-32214: Llhttp HTTP Request Smuggling Vulnerability

CVE-2022-32214 Overview

CVE-2022-32214 is an HTTP Request Smuggling vulnerability affecting the llhttp parser in the Node.js http module. The llhttp parser in versions prior to v14.20.1, v16.17.1, and v18.9.1 does not strictly enforce the use of CRLF (Carriage Return Line Feed) sequences to delimit HTTP requests. This improper parsing behavior can be exploited to perform HTTP Request Smuggling (HRS) attacks, allowing attackers to bypass security controls, poison web caches, and hijack user sessions.

Critical Impact

Attackers can exploit this vulnerability to smuggle malicious HTTP requests through intermediary proxies or load balancers, potentially bypassing security controls and compromising backend server integrity.

Affected Products

• Node.js versions prior to v14.20.1 (LTS)
• Node.js versions prior to v16.17.1 (LTS)
• Node.js versions prior to v18.9.1
• llhttp parser (embedded in Node.js)
• Debian Linux 11.0
• Stormshield Management Center

Discovery Timeline

• 2022-07-14 - CVE-2022-32214 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-32214

Vulnerability Analysis

This vulnerability resides in the llhttp HTTP parser library used by Node.js to process incoming HTTP requests. The core issue is that the parser does not strictly require CRLF (\r\n) sequences to delimit HTTP request headers and bodies. According to RFC 7230, HTTP/1.1 message parsing should strictly use CRLF as the line terminator. When this requirement is not enforced, the parser may accept alternative delimiters such as a standalone LF (\n) character.

This parsing discrepancy creates an opportunity for HTTP Request Smuggling attacks when Node.js applications sit behind reverse proxies, load balancers, or web application firewalls that interpret HTTP requests differently. The vulnerability is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests).

Root Cause

The root cause lies in the llhttp parser's lenient acceptance of non-standard line delimiters in HTTP request parsing. The parser was designed to be flexible in handling various HTTP request formats, but this flexibility violates strict HTTP/1.1 specifications. When front-end and back-end servers interpret the same HTTP stream differently due to delimiter handling inconsistencies, request boundaries become ambiguous, enabling smuggling attacks.

Attack Vector

HTTP Request Smuggling attacks exploiting this vulnerability occur over the network and require no authentication or user interaction. An attacker crafts a malicious HTTP request that contains ambiguous delimiters. When this request passes through a chain of servers (e.g., a reverse proxy forwarding to a Node.js backend), each server may interpret the request boundaries differently.

The attack typically works as follows: The front-end proxy sees one complete request and forwards it to the backend. However, the Node.js backend, due to its lenient parsing, interprets the data as containing multiple requests. The "smuggled" second request can then be processed in the context of another user's connection, enabling session hijacking, cache poisoning, or security control bypass.

For detailed technical analysis of the vulnerability mechanism, see the HackerOne Report #1524692 and the Node.js Security Advisory.

Detection Methods for CVE-2022-32214

Indicators of Compromise

• Unusual HTTP request patterns with non-standard line terminators (single LF instead of CRLF)
• Anomalous request splitting observed in proxy or WAF logs
• Unexpected request routing or cache behavior indicating smuggled requests
• Backend servers processing requests that don't appear in front-end access logs

Detection Strategies

• Deploy deep packet inspection to detect HTTP requests with inconsistent line delimiters
• Implement request integrity validation at both proxy and application layers
• Configure WAF rules to reject HTTP requests that do not strictly conform to RFC 7230
• Enable detailed logging on both front-end proxies and Node.js backends to correlate request patterns

Monitoring Recommendations

• Monitor for request desynchronization between proxy logs and application server logs
• Set up alerts for unusual cache poisoning indicators or unexpected response variations
• Track Node.js application version inventories to identify unpatched instances
• Review access patterns for signs of session hijacking or unauthorized data access

How to Mitigate CVE-2022-32214

Immediate Actions Required

• Upgrade Node.js to version 14.20.1, 16.17.1, or 18.9.1 or later immediately
• Audit all production systems running Node.js to verify current versions
• Review proxy and load balancer configurations to ensure strict HTTP parsing
• Implement additional request validation at the application layer as a defense-in-depth measure

Patch Information

Node.js released security patches addressing this vulnerability in July 2022. The fixed versions include:

• Node.js v14.20.1 (LTS Fermium)
• Node.js v16.17.1 (LTS Gallium)
• Node.js v18.9.1 (Current)

For complete details, refer to the Node.js July 2022 Security Releases. Debian users should apply the patches from DSA-5326.

Workarounds

• Configure front-end proxies to normalize HTTP requests and strictly enforce CRLF delimiters before forwarding
• Implement strict Content-Length validation and reject requests with ambiguous headers
• Deploy a WAF with HTTP Request Smuggling detection capabilities as an interim protection layer
• Consider temporarily disabling HTTP/1.1 keep-alive connections to reduce smuggling attack surface

# Verify Node.js version and upgrade if necessary
node --version
# If version is below 14.20.1, 16.17.1, or 18.9.1, upgrade:
# Using nvm (Node Version Manager):
nvm install 18.9.1
nvm use 18.9.1
# Or using package manager (Debian/Ubuntu):
sudo apt update && sudo apt upgrade nodejs