Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2022-35256 — MEDIUM severity vulnerability | Release Alert

CVE-2022-35256

6.5

MEDIUMCVSS v3

Published

December 5, 2022

Affected

10 projects

Assigned by

[email protected]

Severity scale

010

Description

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

@externs/nodejs

NPMThe Closure Compiler Externs For Node.JS.

>= 14.0.0, <= 14.14.0, >= 16.0.0, <= 16.12.0, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1, = *, >= 14.15.0, < 14.20.1NVD

GitHubThe Externs For Node.JS.

>= 14.0.0, <= 14.14.0, >= 16.0.0, <= 16.12.0, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1, = *, >= 14.15.0, < 14.20.1NVD

More on this CVE

NVD↗GitHub Advisory↗

NPMMocks Of Built-In Node.JS Modules To Use For Compilation.

>= 14.0.0, <= 14.14.0, >= 16.0.0, <= 16.12.0, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1, = *, >= 14.15.0, < 14.20.1NVD

@opencensus/nodejs

NPMOpenCensus is a toolkit for collecting application performance and behavior data.

>= 14.0.0, <= 14.14.0, >= 16.0.0, <= 16.12.0, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1, = *, >= 14.15.0, < 14.20.1NVD

GitHubMocks Of Built-In Node.JS Modules To Use For Compilation.

>= 14.0.0, <= 14.14.0, >= 16.0.0, <= 16.12.0, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1, = *, >= 14.15.0, < 14.20.1NVD

Python Package IndexPython bindings and utils for Node.js and io.js

>= 14.0.0, <= 14.14.0, >= 16.0.0, <= 16.12.0, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1, = *, >= 14.15.0, < 14.20.1NVD

NPM

>= 14.0.0, <= 14.14.0, >= 16.0.0, <= 16.12.0, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1, = *, >= 14.15.0, < 14.20.1NVD

Crates.ioEmbedding Node.js in Rust

>= 14.0.0, <= 14.14.0, >= 16.0.0, <= 16.12.0, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1, = *, >= 14.15.0, < 14.20.1NVD

NPMsecurity holding package

>= 14.0.0, <= 14.14.0, >= 16.0.0, <= 16.12.0, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1, = *, >= 14.15.0, < 14.20.1NVD

NuGet GalleryNode.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

>= 14.0.0, <= 14.14.0, >= 16.0.0, <= 16.12.0, >= 16.13.0, < 16.17.1, >= 18.0.0, < 18.9.1, = *, >= 14.15.0, < 14.20.1NVD