Live › vulnerability › VND-nodejs-july-2022-security-releases
Go to dashboardNode.js 14, 16 and 18 shipped fixes for several flaws: llhttp parsing bugs that enable HTTP request smuggling, a DNS rebinding bypass in the --inspect debugger that can lead to code execution, a DLL hijack on Windows when OpenSSL is installed, and a minor OpenSSL AES-OCB memory disclosure. Attackers can smuggle requests past front-end proxies, run code through the debugger if it is exposed, or run code on Windows hosts by planting providers.dll.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
Any application running on the affected Node.js lines is exposed to the llhttp request smuggling flaws if it parses HTTP requests, which includes most Node HTTP servers behind proxies. The debugger and DLL hijack issues need the --inspect flag or a Windows host with OpenSSL installed, so machines that never run those are less exposed. Teams on the fixed release lines or on managed hosting that patched the runtime can skip the upgrade.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| node | node | >= 14.0.0, < 14.20.0 | 14.20.0 |
| node | node | >= 16.0.0, < 16.16.0 | 16.16.0 |
| node | node | >= 18.0.0, < 18.5.0 | 18.5.0 |
node --version and compare against the fixed versions: 14.20.0, 16.16.0, 18.5.0.C:\Program Files\Common Files\SSL\openssl.cnf exists and whether Node is run with --inspect.--inspect or --inspect-brk and reachable from a network.14.20.0 or later.16.16.0 or later.18.5.0 or later.--inspect debugger port beyond localhost.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Security releases available Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues. HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213) The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2022-32213 after publication. Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability. Impacts: All versions of the 18.x, 16.x, and 14.x releases lines. llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js HTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214) The llhttp parser in the http module does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2022-32214 after publication. Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability. Impacts: All versions of the 18.x, 16.x, and 14.x releases lines. llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215) The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2022-32215 after publication. Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability. Impacts: All versions of the 18.x, 16.x, and 14.x releases lines. llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js DNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212) The IsAllowedHost check can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), browsers (such as Firefox) will make DNS requests to the DNS server, providing a vector for an attacker-controlled DNS server or a MITM who can spoof DNS responses to perform a rebinding attack and hence connect to the WebSocket debugger, allowing for arbitrary code execution. This is a bypass of CVE-2021-22884. More details will be available at CVE-2022-32212 after publication. Thank you to Axel Chong for reporting this vulnerability. Impacts: All versions of the 18.x, 16.x, and 14.x releases lines. DLL Hijacking on Windows (High)(CVE-2022-32223) This vulnerability can be exploited if the victim has the following dependencies on Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists. Whenever the above conditions are present, node.exe will search for providers.dll in the current user directory. After that, node.exe will try to search for providers.dll by the DLL Search Order in Windows. It is possible for an attacker to place the malicious file providers.dll under a variety of paths and exploit this vulnerability. More details will be available at CVE-2022-32223 after publication. Thank you to Yakir Kadkoda from Aqua Security for reporting this vulnerability. Impacts: All versions of the 16.x, and 14.x releases lines. Note: This is a breaking change that has been made to the v14.x, v16.x, and v18.x releases lines. Node.js can use an OpenSSL configuration file by specifying the environment variable OPENSSL_CONF , or using the command line option --openssl-conf , and if none of those are specified will default to reading the default OpenSSL configuration file openssl.cnf . Node.js will only read a section that is by default named nodejs_conf . If your installation was using the default openssl.cnf file and is affected by this breaking change you can fall back to the previous behavior by: Adding --openssl-shared-config to the command line (Node.js 18.5.0 only); or Creating a new nodejs_conf section in that file and copying the contents of the default section into the new nodejs_conf section. Attempt to read openssl.cnf from /home/iojs/build/ upon startup (Medium)(CVE-2022-32222) When Node.js starts on linux based systems, it attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf , which ordinarily doesn't exist. On some shared systems an attacker may be able create this file and therefore affect the default OpenSSL configuration for other users. Thank you to Michael Scovetta from the OpenSSF Alpha-Omega project for reporting this vulnerability. Impacts: Node.js 18.x OpenSSL - AES OCB fails to encrypt some bytes (Medium)(CVE-2022-2097) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Impacts: All versions of the 18.x, 16.x, and 14.x releases lines. Downloads and release details Node.js v14.20.0 (LTS) Node.js v16.16.0 (LTS) Node.js v18.5.0 (Current) (Update 07-Jul-2022) Security Release target July 7th The Node.js Security Releases will be available on, or shortly after, Thursday, July 7th, 2022. (Update 05-Jul-2022) OpenSSL Security Release Assessement With respect to the vulnerabilities in the OpenSSL Security releases of Jul 5th 2022 affects Node.js v18.x, v16.x, and v14.x. Node.js is affected by one MODERATE vulnerability on Windows 32-Bit x86. The security release will be delayed so that we can incorporate the updated OpenSSL versions. We will post another update once we have an updated target for the release date. Analysis Our assessment of the security advisory is: Heap memory corruption with RSA private key operation (CVE-2022-2274) (HIGH) This vulnerability affects OpenSSL 3.0.4 users. However, Node.js has not shipped any version that used OpenSSL 3.0.4. Therefore, Node.js is not affected. AES OCB fails to encrypt some bytes (CVE-2022-2097) (MODERATE) This vulnerability affects Windows 32-Bit x86 users using AES OCB encryption. The severity is MODERATE. (Update 04-Jul-2022) OpenSSL Security Release The OpenSSL versions 1.1.1q and 3.0.5 will be released July, 5th 2022. The announcement can be found here: https://mta.openssl.org/pipermail/openssl-announce/2022-July/000229.html The Node.js team will evaluate the OpenSSL changes when they are available and then announce the new target date by Thursday or earlier. Summary The Node.js project will release new versions of the 14.x, 16.x, and 18.x releases lines on or shortly after Tuesday, July 5th, 2022 in order to address: Three medium severity issues. Two high severity issues. Impact The 18.x release line of Node.js is vulnerable to three medium severity issues and one high severity issues. The 16.x release line of Node.js is vulnerable to three medium severity issues and two high severity issues. The 14.x release line of Node.js is vulnerable to three medium severity issues and two high severity issues. Release timing Releases will be available on, or shortly after, Tuesday, July 5th, 2022. However, when details of the OpenSSL defects are released on the 5th, our team will be making a more detailed assessment on the likely severity for Node.js users. The OpenSSL release may delay the Node.js release date. Please monitor the nodejs-sec Google Group for updates, including a decision within 24 hours after the OpenSSL release regarding release timing, and full details of the defects upon eventual release: https://groups.google.com/forum/#!forum/nodejs-sec Contact and future updates The current Node.js security policy can be found at /security/. Please follow the process outlined in https://github.com/nodejs/node/security/policy if you wish to report a
This page as .md · .json · in your agent: get_signal("VND-nodejs-july-2022-security-releases")