Security readout for executives and security teams
Plain-English summary
CVE-2021-22960 is a Node.js llhttp parsing flaw that can enable HTTP request smuggling in some chunked-request scenarios. In plain terms, a front-end and back-end server may disagree about where one request ends, letting traffic be misinterpreted. Business risk depends on whether exposed services use affected Node.js or llhttp versions behind HTTP intermediaries.
Executive priority
Treat this as a high-priority web infrastructure issue where affected Node.js services are externally reachable. There is no KEV evidence in the bundle, but request smuggling can undermine access controls and routing assumptions, so patch validation should be prioritized for exposed and proxy-backed services.
Technical view
The llhttp parse function before 2.1.4 and before 6.0.6 ignores chunk extensions while parsing chunked request bodies. The CVE maps to CWE-444 and can produce HTTP request smuggling under certain conditions. The source bundle lists Node.js versions 4 through 16 as affected context, but does not provide CVSS scoring.
Likely exposure
Most relevant exposure is internet-facing Node.js services or products using vulnerable llhttp versions, especially when deployed behind proxies, load balancers, gateways, or other HTTP intermediaries. Source evidence names Node.js versions 4.0 through 16.0 and llhttp versions below the fixed thresholds.
Exploitation context
The bundle does not show CISA KEV listing or confirmed active exploitation. Public references include a HackerOne report and vendor advisories, indicating public disclosure and downstream vendor handling. Exploitation requires specific HTTP parsing conditions, so exposure should be validated against actual runtime and proxy architecture.
Researcher notes
Evidence is sufficient for vulnerability class, parser behavior, affected llhttp thresholds, and Node.js exposure context. The bundle lacks CVSS, detailed exploit preconditions, and product-specific fixed Node.js release numbers. Avoid assuming exploitation or universal exploitability without confirming the deployed proxy-origin combination.
Mitigation direction
- Upgrade llhttp to 2.1.4, 6.0.6, or later where directly used.
- Update Node.js runtime packages through vendor-supported security releases.
- Check Debian and Oracle advisories for package-specific fixed versions.
- Prioritize internet-facing services behind HTTP proxies or gateways.
- Retire unsupported Node.js versions where security fixes are unavailable.
Validation and detection
- Inventory Node.js versions across internet-facing applications and appliances.
- Identify applications or dependencies directly embedding llhttp.
- Map services behind reverse proxies, gateways, or load balancers.
- Confirm patched package versions against vendor advisories.
- Review logs for unexplained request-routing or malformed chunked-request anomalies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-444: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-22960 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://hackerone.com/reports/1238099CVE reference · x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.htmlCVE reference · x_refsource_MISC
- DSA-5170CVE reference · vendor-advisory, x_refsource_DEBIAN
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.