Injection and Smuggling

Every one of the 18 is a mark on the map. Named now: 1 to 18, most at risk first.

1. The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request S…CVE-2022-32214NodeJS · 82% likely

   CWE-4442 bounty reports

2. The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smu…CVE-2022-32215NodeJS · 70% likely

   CWE-4443 bounty reports

3. HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformedCVE-2019-15605NodeJS · 57% likely

   CWE-4441 bounty report

4. The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smug…CVE-2022-32213NodeJS · 45% likely

   CWE-4443 bounty reports

5. Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, N…CVE-2020-8287NodeJS · 16% likely

   CWE-4441 bounty report

6. Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to h…CVE-2020-8201NodeJS · 5.3% likely

   CWE-4441 bounty report

7. CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote…CVE-2016-5325Nodejs · 4.1% likely

   CWE-113

8. The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.CVE-2021-22959NodeJS · 3.2% likely

   CWE-4441 bounty report

9. A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname…CVE-2026-48618nodejs · CVSS 7.7 · 3.1% likelycovered by CyberSIXT

   CWE-1761 bounty report

10. The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.CVE-2022-35256NodeJS · CVSS 6.5 · 2.8% likely

    CWE-4442 bounty reports

11. The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain cond…CVE-2021-22960NodeJS · 2.5% likely

    CWE-4441 bounty report

12. CRLF injection in request headersCVE-2022-31150nodejs · CVSS 5.3 · 1.5% likely

    CWE-93

13. CRLF Injection in Nodejs ‘undici’ via Content-TypeCVE-2022-35948nodejs · CVSS 5.3 · 1.4% likely

    CWE-931 bounty report

14. The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, i…CVE-2024-27982NodeJS · CVSS 6.5 · 1.2% likely

    CWE-4441 bounty report

15. CRLF Injection in Nodejs ‘undici’ via hostCVE-2023-23936nodejs · CVSS 6.5 · 1.1% likely

    CWE-931 bounty report

16. A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling,…CVE-2025-23167nodejs · CVSS 6.5 · 0.5% likely

    CWE-4441 bounty report

17. A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers w…CVE-2026-58044nodejs · CVSS 3.7 · 0.3% likely

    CWE-4441 bounty report

18. A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers w…CVE-2026-48932nodejs · CVSS 3.7 · 0.3% likely

    CWE-4441 bounty report

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.