Security readout for executives and security teams
Plain-English summary
This flaw lets some malformed HTTP headers be accepted by llhttp, the parser used by Node.js. In proxy or load-balancer setups, inconsistent parsing can enable HTTP request smuggling, where one system sees a different request boundary than another.
Executive priority
Treat this as a high-priority hygiene issue for public web and API platforms. It is not confirmed exploited in the provided evidence, but request smuggling can undermine perimeter controls and affect confidentiality, routing, and access boundaries.
Technical view
CVE-2021-22959 is a CWE-444 HTTP request smuggling issue. llhttp before v2.1.4 and before v6.0.6 accepts a space after a header name before the colon, creating parser disagreement risk across HTTP chains. The source bundle lists NodeJS Node versions 4.0 through 16.0.
Likely exposure
Exposure is most likely where Node.js or embedded llhttp handles inbound HTTP behind proxies, CDNs, API gateways, or load balancers. Source data identifies llhttp version ranges and NodeJS Node versions, but does not provide a complete deployment-specific impact matrix.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The risk is structural: request smuggling can bypass routing, caching, or security controls when front-end and back-end HTTP parsers disagree.
Researcher notes
Focus analysis on parser differentials across each HTTP hop. The source evidence is specific to acceptance of whitespace before the header colon in llhttp ranges; do not generalize to unrelated Node.js parser issues without vendor confirmation.
Mitigation direction
- Inventory Node.js runtimes and embedded llhttp versions across internet-facing services.
- Upgrade llhttp to versions outside the listed vulnerable ranges where directly embedded.
- Apply vendor-provided Node.js, Debian, Oracle, or appliance updates relevant to your environment.
- Prioritize systems behind proxies, CDNs, gateways, or load balancers.
- Check current vendor advisories before assuming a backported package is fixed.
Validation and detection
- Confirm runtime and package versions against vendor advisories and asset inventory.
- Verify Debian systems include the fixes referenced by DSA-5170 where applicable.
- Review Oracle product exposure against the January 2022 Critical Patch Update.
- Check HTTP edge and application logs for anomalous malformed header patterns.
- Run regression testing for HTTP parsing after applying vendor updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-444: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-22959 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://hackerone.com/reports/1238709CVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.htmlCVE reference · x_refsource_MISC
- DSA-5170CVE reference · vendor-advisory, x_refsource_DEBIAN
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.