{"id":"VND-nodejs-july-2022-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2021-22884","CVE-2022-2097","CVE-2022-2274","CVE-2022-32212","CVE-2022-32213","CVE-2022-32214","CVE-2022-32215","CVE-2022-32222","CVE-2022-32223"],"title":"Node.js: July 7th 2022 Security Releases","description":"Security releases available\nUpdates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the\nfollowing issues.\nHTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213)\nThe llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers.\nThis can lead to HTTP Request Smuggling (HRS).\nMore details will be available at CVE-2022-32213 after publication.\nThank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.\nImpacts:\nAll versions of the 18.x, 16.x, and 14.x releases lines.\nllhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js\nHTTP Request Smuggling - Improper Delimiting of Header Fields (Medium)(CVE-2022-32214)\nThe llhttp parser in the http module does not strictly use the CRLF sequence to delimit HTTP requests.\nThis can lead to HTTP Request Smuggling (HRS).\nMore details will be available at CVE-2022-32214 after publication.\nThank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.\nImpacts:\nAll versions of the 18.x, 16.x, and 14.x releases lines.\nllhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js\nHTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215)\nThe llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers.\nThis can lead to HTTP Request Smuggling (HRS).\nMore details will be available at CVE-2022-32215 after publication.\nThank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.\nImpacts:\nAll versions of the 18.x, 16.x, and 14.x releases lines.\nllhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js\nDNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212)\nThe IsAllowedHost check can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not.\nWhen an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), browsers (such as Firefox) will make DNS requests to the DNS server,\nproviding a vector for an attacker-controlled DNS server or a MITM who can spoof DNS responses to perform a rebinding attack and hence connect to the WebSocket debugger, allowing for arbitrary code execution. This is a bypass of CVE-2021-22884.\nMore details will be available at CVE-2022-32212 after publication.\nThank you to Axel Chong for reporting this vulnerability.\nImpacts:\nAll versions of the 18.x, 16.x, and 14.x releases lines.\nDLL Hijacking on Windows (High)(CVE-2022-32223)\nThis vulnerability can be exploited if the victim has the following dependencies on Windows machine:\nOpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.\nWhenever the above conditions are present, node.exe will search for providers.dll in the current user directory.\nAfter that, node.exe will try to search for providers.dll by the DLL Search Order in Windows.\nIt is possible for an attacker to place the malicious file providers.dll under a variety of paths and exploit this vulnerability.\nMore details will be available at CVE-2022-32223 after publication.\nThank you to Yakir Kadkoda from Aqua Security for reporting this vulnerability.\nImpacts:\nAll versions of the 16.x, and 14.x releases lines.\nNote:\nThis is a breaking change that has been made to the v14.x, v16.x, and v18.x releases lines.\nNode.js can use an OpenSSL configuration file by specifying the environment\nvariable OPENSSL_CONF , or using the command line option --openssl-conf , and\nif none of those are specified will default to reading the default OpenSSL\nconfiguration file openssl.cnf . Node.js will only read a section that is by\ndefault named nodejs_conf .\nIf your installation was using the default openssl.cnf file and is affected by this breaking change\nyou can fall back to the previous behavior by:\nAdding --openssl-shared-config to the command line (Node.js 18.5.0 only); or\nCreating a new nodejs_conf section in that file and copying the contents of the default section into the new nodejs_conf section.\nAttempt to read openssl.cnf from /home/iojs/build/ upon startup (Medium)(CVE-2022-32222)\nWhen Node.js starts on linux based systems, it attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf ,\nwhich ordinarily doesn&#x27;t exist. On some shared systems an attacker may be able create this file and therefore affect the default OpenSSL configuration for other users.\nThank you to Michael Scovetta from the OpenSSF Alpha-Omega project for reporting this vulnerability.\nImpacts:\nNode.js 18.x\nOpenSSL - AES OCB fails to encrypt some bytes (Medium)(CVE-2022-2097)\nAES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised\nimplementation will not encrypt the entirety of the data under some\ncircumstances. This could reveal sixteen bytes of data that was\npreexisting in the memory that wasn&#x27;t written. In the special case of\n&quot;in place&quot; encryption, sixteen bytes of the plaintext would be revealed.\nSince OpenSSL does not support OCB based cipher suites for TLS and DTLS,\nthey are both unaffected.\nImpacts:\nAll versions of the 18.x, 16.x, and 14.x releases lines.\nDownloads and release details\nNode.js v14.20.0 (LTS)\nNode.js v16.16.0 (LTS)\nNode.js v18.5.0 (Current)\n(Update 07-Jul-2022) Security Release target July 7th\nThe Node.js Security Releases will be available on, or shortly after, Thursday, July 7th, 2022.\n(Update 05-Jul-2022) OpenSSL Security Release Assessement\nWith respect to the vulnerabilities in the OpenSSL Security releases of Jul 5th 2022 affects Node.js v18.x, v16.x, and v14.x.\nNode.js is affected by one MODERATE vulnerability on Windows 32-Bit x86.\nThe security release will be delayed so that we can incorporate the updated OpenSSL versions. We\nwill post another update once we have an updated target for the release date.\nAnalysis\nOur assessment of the security advisory is:\nHeap memory corruption with RSA private key operation (CVE-2022-2274) (HIGH)\nThis vulnerability affects OpenSSL 3.0.4 users. However, Node.js has not shipped any version that used OpenSSL 3.0.4.\nTherefore, Node.js is not affected.\nAES OCB fails to encrypt some bytes (CVE-2022-2097) (MODERATE)\nThis vulnerability affects Windows 32-Bit x86 users using AES OCB encryption. The severity is MODERATE.\n(Update 04-Jul-2022) OpenSSL Security Release\nThe OpenSSL versions 1.1.1q and 3.0.5 will be released July, 5th 2022. The announcement can be found here: https://mta.openssl.org/pipermail/openssl-announce/2022-July/000229.html\nThe Node.js team will evaluate the OpenSSL changes when they are available and then announce the new target date by Thursday or earlier.\nSummary\nThe Node.js project will release new versions of the 14.x, 16.x, and 18.x\nreleases lines on or shortly after Tuesday, July 5th, 2022 in order to address:\nThree medium severity issues.\nTwo high severity issues.\nImpact\nThe 18.x release line of Node.js is vulnerable to three medium severity issues and one high severity issues.\nThe 16.x release line of Node.js is vulnerable to three medium severity issues and two high severity issues.\nThe 14.x release line of Node.js is vulnerable to three medium severity issues and two high severity issues.\nRelease timing\nReleases will be available on, or shortly after, Tuesday, July 5th, 2022.\nHowever, when details of the OpenSSL defects are released on the 5th, our team will be making a more detailed assessment\non the likely severity for Node.js users.\nThe OpenSSL release may delay the Node.js release date.\nPlease monitor the nodejs-sec Google Group for updates, including a decision within 24 hours after the OpenSSL release regarding release timing, and full details of the defects upon eventual release: https://groups.google.com/forum/#!forum/nodejs-sec\nContact and future updates\nThe current Node.js security policy can be found at /security/. Please follow the process outlined in https://github.com/nodejs/node/security/policy if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous September 23rd 2022 Security Releases Next OpenSSL update assessment, and Node.js project plans","summary":"Node.js 14, 16 and 18 shipped fixes for several flaws: llhttp parsing bugs that enable HTTP request smuggling, a DNS rebinding bypass in the --inspect debugger that can lead to code execution, a DLL hijack on Windows when OpenSSL is installed, and a minor OpenSSL AES-OCB memory disclosure. Attackers can smuggle requests past front-end proxies, run code through the debugger if it is exposed, or run code on Windows hosts by planting providers.dll.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":["14.20.0"],"affected":">= 14.0.0, < 14.20.0","ecosystem":"node"},{"name":"node","fixed":["16.16.0"],"affected":">= 16.0.0, < 16.16.0","ecosystem":"node"},{"name":"node","fixed":["18.5.0"],"affected":">= 18.0.0, < 18.5.0","ecosystem":"node"}],"ecosystems":["node"],"tags":["http-servers","node","runtime","self-hosted","windows"],"not_affected_if":["fixed-version","no-inspect-flag","non-windows-for-dll"],"how_to_check":"- Run `node --version` and compare against the fixed versions: `14.20.0`, `16.16.0`, `18.5.0`.\n- On Windows, check whether `C:\\Program Files\\Common Files\\SSL\\openssl.cnf` exists and whether Node is run with `--inspect`.\n- Check whether any service is started with `--inspect` or `--inspect-brk` and reachable from a network.","fix":"- Upgrade Node.js 14.x to `14.20.0` or later.\n- Upgrade Node.js 16.x to `16.16.0` or later.\n- Upgrade Node.js 18.x to `18.5.0` or later.\n- Stop exposing the `--inspect` debugger port beyond localhost.","status":"open","published_at":"2022-07-07T16:00:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:41:49+00:00","updated_at":"2026-10-25T05:41:49+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T05:41:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js 14.x to `14.20.0` or later.\n- Upgrade Node.js 16.x to `16.16.0` or later.\n- Upgrade Node.js 18.x to `18.5.0` or later.\n- Stop exposing the `--inspect` debugger port beyond localhost.","reach":"network","title":"Node.js: July 2022 releases fix request smuggling, debugger takeover and Windows DLL hijack","impact":"high","summary":"Node.js 14, 16 and 18 shipped fixes for several flaws: llhttp parsing bugs that enable HTTP request smuggling, a DNS rebinding bypass in the --inspect debugger that can lead to code execution, a DLL hijack on Windows when OpenSSL is installed, and a minor OpenSSL AES-OCB memory disclosure. Attackers can smuggle requests past front-end proxies, run code through the debugger if it is exposed, or run code on Windows hosts by planting providers.dll.","category":"runtime","nicknames":[],"who_cares":["node","self-hosted","windows","http-servers"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker smuggles requests past a proxy or runs code on Windows hosts","analyst_note":"","how_to_check":"- Run `node --version` and compare against the fixed versions: `14.20.0`, `16.16.0`, `18.5.0`.\n- On Windows, check whether `C:\\Program Files\\Common Files\\SSL\\openssl.cnf` exists and whether Node is run with `--inspect`.\n- Check whether any service is started with `--inspect` or `--inspect-brk` and reachable from a network.","needs_analyst":false,"not_affected_if":["fixed-version","no-inspect-flag","non-windows-for-dll"],"who_is_affected":"Any application running on the affected Node.js lines is exposed to the llhttp request smuggling flaws if it parses HTTP requests, which includes most Node HTTP servers behind proxies. The debugger and DLL hijack issues need the --inspect flag or a Windows host with OpenSSL installed, so machines that never run those are less exposed. Teams on the fixed release lines or on managed hosting that patched the runtime can skip the upgrade.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.001068,"input_tokens":6558,"output_tokens":824,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2021':484C '-2022':135C,169C,220C,255C,310C,345C,396C,493C,526C,616C '-22884':485C '-32212':397C,494C '-32213':136C,170C '-32214':221C,256C '-32215':311C,346C '-32223':527C,617C '10.0.2.555':428C '14':28B,193C,279C,369C,516C,640C '16':29B,190C,276C,366C,513C,637C '18':31B,188C,274C,364C,511C '18.5.0':750C '2022':4A,11A '7th':3A 'add':740C 'address':393C,414C,423C 'ae':73B 'aes-ocb':72B 'affect':726C 'allow':473C 'aqua':626C 'arbitrari':475C 'attack':77B,449C,465C,593C 'attacker-control':448C 'avail':106C,110C,166C,252C,342C,490C,613C 'axel':500C 'back':734C 'behavior':738C 'break':648C,729C 'browser':431C 'bug':39B 'bypass':48B,404C,481C 'c':548C 'chang':649C,730C 'check':400C,410C 'chong':501C 'code':57B,87B,97B,476C 'command':679C,747C 'common':551C 'condit':559C 'conf':675C,684C,714C,757C 'config':744C 'configur':667C,699C 'connect':468C 'contain':202C,288C,378C 'control':450C 'copyi':763C 'correct':146C,321C 'creat':753C 'crlf':234C 'current':569C 'cve':134C,168C,219C,254C,309C,344C,395C,483C,492C,525C,615C 'debugg':52B,90B,472C 'default':693C,697C,711C,721C 'delimit':214C,237C 'depend':539C 'detail':163C,249C,339C,487C,610C 'directori':571C 'disclosur':76B 'dll':60B,520C,583C 'dns':46B,386C,437C,441C,451C,459C 'easili':402C 'enabl':41B 'encod':132C,152C,307C,328C 'end':84B 'environ':672C 'execut':58B,477C 'exist':555C 'exploit':532C,606C 'expos':94B 'fall':733C 'field':217C 'file':550C,552C,598C,668C,700C,723C,761C 'firefox':434C 'fix':33B,204C,290C,380C 'flaw':36B,127C 'follow':122C,538C 'front':83B 'front-end':82B 'handl':322C 'header':153C,216C,329C 'henc':467C 'high':394C,524C 'hijack':61B,521C 'host':25B,100B 'hrs':161C,247C,337C 'http':19B,42B,124C,142C,158C,210C,227C,238C,244C,296C,317C,334C 'http-server':18B 'impact':183C,269C,359C,506C,632C 'improp':213C 'incorrect':299C 'insid':208C,294C,384C 'inspect':51B,389C 'instal':67B,546C,717C 'instanc':427C 'invalid':391C,416C,421C 'ip':392C,413C 'ipv4':422C 'isallowedhost':399C 'isipaddress':406C 'issu':123C 'juli':2A 'july':10A 'kadkoda':624C 'lead':55B,156C,242C,332C 'line':119C,196C,282C,304C,325C,372C,519C,643C,661C,680C,748C 'llhttp':37B,138C,197C,200C,223C,283C,286C,313C,373C,376C 'machin':542C 'made':653C 'make':436C 'malici':597C 'medium':133C,218C,308C 'memori':75B 'minor':70B 'mitm':455C 'modul':143C,228C,318C 'multi':303C,324C 'multi-lin':302C,323C 'name':712C 'new':755C 'node':15A,16A,17A,21B 'node.exe':562C,574C 'node.js':1A,27B,117C,209C,295C,385C,662C,702C,749C 'nodej':713C,756C 'nodejs':9A 'none':687C 'note':644C 'ocb':74B 'openssl':65B,71B,543C,666C,674C,683C,698C,742C 'openssl-conf':682C 'openssl-shared-config':741C 'openssl.cnf':554C,701C,722C 'option':681C 'order':585C 'pars':38B,128C,147C,300C 'parser':139C,224C,314C 'past':81B 'path':604C 'perform':462C 'place':595C 'plant':102B 'possibl':590C 'present':561C 'previous':737C 'program':549C 'proper':409C 'provid':425C,430C,443C 'providers.dll':103B,566C,580C,599C 'proxi':85B 'public':172C,258C,348C,496C,619C 'read':695C,705C 'rebind':47B,387C,464C 'releas':6A,105C,118C,195C,281C,371C,518C,642C,660C 'releases':14A 'report':180C,266C,356C,503C,629C 'request':43B,80B,125C,159C,211C,239C,245C,297C,335C,438C 'respons':460C 'run':86B,96B 'runtim':22B 'search':564C,578C,584C 'section':707C,758C 'secur':5A,104C,627C 'security':13A 'security-releases':12A 'self':24B 'self-host':23B 'sequenc':235C 'server':20B,442C,452C 'sever':35B 'share':743C 'ship':32B 'smuggl':44B,79B,126C,160C,212C,246C,298C,336C 'specifi':670C,691C 'spoof':458C 'ssl':553C 'strict':231C 'thank':173C,259C,349C,497C,620C 'transfer':131C,151C,306C,327C 'transfer-encod':130C,150C,305C,326C 'tri':576C 'updat':107C,207C,293C,383C 'use':232C,664C,677C,719C 'user':570C 'v14.x':116C,656C 'v16.x':114C,657C 'v18.x':113C,659C 'v2.1.5':201C,287C,377C 'v6.0.7':198C,284C,374C 'valid':149C 'variabl':673C 'varieti':602C 'vector':445C 'version':185C,271C,361C,508C,634C 'via':390C 'victim':535C 'vnd':8A 'vnd-nodejs-july':7A 'vulner':182C,268C,358C,505C,529C,608C,631C 'websocket':471C 'whenev':556C 'window':26B,63B,99B,523C,541C,587C 'x':189C,191C,194C,275C,277C,280C,365C,367C,370C,512C,514C,517C,638C,641C 'yakir':623C 'zeyu':176C,262C,352C 'zeyu2001':178C,264C,354C 'zhang':177C,263C,353C","nicknames":[],"mitigations":[],"who_affected":"Any application running on the affected Node.js lines is exposed to the llhttp request smuggling flaws if it parses HTTP requests, which includes most Node HTTP servers behind proxies. The debugger and DLL hijack issues need the --inspect flag or a Windows host with OpenSSL installed, so machines that never run those are less exposed. Teams on the fixed release lines or on managed hosting that patched the runtime can skip the upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2022-07-07T16:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"july-2022-security-releases","url":"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases","severity":"high","published_at":"2022-07-07T16:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T18:27:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}