{
  "resultsPerPage": 1,
  "startIndex": 0,
  "totalResults": 1,
  "format": "NVD_CVE",
  "version": "2.0",
  "timestamp": "2023-05-20T20:17:04.630",
  "vulnerabilities": [
    {
      "cve": {
        "id": "CVE-2022-32214",
        "sourceIdentifier": "support@hackerone.com",
        "published": "2022-07-14T15:15:08.337",
        "lastModified": "2023-02-23T16:32:25.683",
        "vulnStatus": "Analyzed",
        "descriptions": [
          {
            "lang": "en",
            "value": "The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS)."
          },
          {
            "lang": "es",
            "value": "El parser llhttp anteriores a la versión v14.20.1, anteriores a la versión v16.17.1 y anteriores a la versión v18.9.1 del módulo http en Node.js no utiliza estrictamente la secuencia CRLF para delimitar las peticiones HTTP. Esto puede llevar a un contrabando de peticiones HTTP (HRS)"
          }
        ],
        "metrics": {
          "cvssMetricV31": [
            {
              "source": "nvd@nist.gov",
              "type": "Primary",
              "cvssData": {
                "version": "3.1",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                "attackVector": "NETWORK",
                "attackComplexity": "LOW",
                "privilegesRequired": "NONE",
                "userInteraction": "NONE",
                "scope": "UNCHANGED",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.5
            }
          ]
        },
        "weaknesses": [
          {
            "source": "nvd@nist.gov",
            "type": "Primary",
            "description": [{ "lang": "en", "value": "CWE-444" }]
          },
          {
            "source": "support@hackerone.com",
            "type": "Secondary",
            "description": [{ "lang": "en", "value": "CWE-444" }]
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "operator": "OR",
                "negate": false,
                "cpeMatch": [
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*",
                    "versionEndExcluding": "2.1.5",
                    "matchCriteriaId": "C2150173-C986-4D63-AA7F-9618AA856F2C"
                  },
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*",
                    "versionStartIncluding": "6.0.0",
                    "versionEndExcluding": "6.0.7",
                    "matchCriteriaId": "FBB4A716-D0D0-4319-BAF0-7F012973330A"
                  },
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
                    "versionStartIncluding": "14.0.0",
                    "versionEndIncluding": "14.14.0",
                    "matchCriteriaId": "428DCD7B-6F66-4F18-B780-5BD80143D482"
                  },
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
                    "versionStartIncluding": "14.15.0",
                    "versionEndExcluding": "14.20.0",
                    "matchCriteriaId": "3EB02718-B2A5-4822-B611-D62BB9EF44B0"
                  },
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
                    "versionStartIncluding": "16.0.0",
                    "versionEndIncluding": "16.12.0",
                    "matchCriteriaId": "1D1D0CEC-62E5-4368-B8F2-1DA5DD0B88FA"
                  },
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
                    "versionStartIncluding": "16.13.0",
                    "versionEndExcluding": "16.16.0",
                    "matchCriteriaId": "D9D9B02E-C965-408B-999E-1F3DA09B62AA"
                  },
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
                    "versionStartIncluding": "18.0.0",
                    "versionEndExcluding": "18.5.0",
                    "matchCriteriaId": "D224E154-915A-4E2C-A0D7-D28D1C1472F7"
                  }
                ]
              }
            ]
          },
          {
            "nodes": [
              {
                "operator": "OR",
                "negate": false,
                "cpeMatch": [
                  {
                    "vulnerable": true,
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
                  }
                ]
              }
            ]
          }
        ],
        "references": [
          {
            "url": "https://hackerone.com/reports/1524692",
            "source": "support@hackerone.com",
            "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"]
          },
          {
            "url": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/",
            "source": "support@hackerone.com",
            "tags": ["Patch", "Vendor Advisory"]
          },
          {
            "url": "https://www.debian.org/security/2023/dsa-5326",
            "source": "support@hackerone.com",
            "tags": ["Third Party Advisory"]
          }
        ]
      }
    }
  ]
}