Skip to main content
cve.nowby Sazabi
← npm
npmPackage

llhttp

3 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3
Registry
npm

Advisories 3

  • The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests.

    Affected: fixed in 8.1.1.

  • The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP…

    Affected: fixed in 6.0.7.

  • The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding…

    Affected: fixed in 6.0.7.