Security readout for executives and security teams
Plain-English summary
CVE-2022-35256 is a Node.js HTTP parser flaw that can let malformed headers create HTTP request smuggling conditions. For executives, the main concern is internet-facing Node services where a front-end proxy and the Node backend interpret requests differently. The published severity is medium, but exposure can matter in authentication or routing-sensitive environments.
Executive priority
Treat this as a moderate-priority remediation for internet-facing Node services and embedded products. Escalate priority where Node backs authentication, routing, multi-tenant traffic, or proxy-mediated public applications. There is no active exploitation evidence in the provided sources.
Technical view
Node.js uses the llhttp parser in its HTTP module. The CVE states that affected Node versions mishandle header fields not terminated with CRLF, potentially causing HTTP Request Smuggling. The record maps this to CWE-444 and CVSS 3.1 score 6.5 with network, unauthenticated, low-complexity exploitation conditions.
Likely exposure
Exposure is most likely in services running affected Node.js versions 4 through 18, especially HTTP applications reachable over a network. Products embedding affected Node components may also be exposed. The Siemens advisory reference indicates downstream product impact exists, but this source bundle does not name specific Siemens products or fixed versions.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. The CVSS vector indicates unauthenticated network reachability and low attack complexity. Request smuggling risk is context-dependent and usually depends on intermediary HTTP infrastructure interpreting malformed requests differently from the backend.
Researcher notes
The record is specific to llhttp handling of headers lacking CRLF termination and potential CWE-444 request smuggling. The bundle gives broad affected Node major versions but not exact fixed releases. Avoid assuming exploitability without confirming the front-end/back-end HTTP parsing chain and runtime version.
Mitigation direction
- Inventory internet-facing services and products using Node.js or embedded Node components.
- Apply vendor security updates for Node.js and downstream distributions such as Debian.
- Check Siemens guidance if Siemens products are present in the environment.
- Prioritize systems behind proxies, gateways, load balancers, or shared front ends.
- Review vendor advisories for exact fixed versions before changing production runtimes.
Validation and detection
- Identify deployed Node.js major versions across servers, containers, and bundled products.
- Confirm whether affected services expose Node HTTP handling to untrusted network traffic.
- Check package manager advisories, Debian DSA-5326, and vendor notices for remediation status.
- Review proxy-to-backend HTTP parsing boundaries for request smuggling exposure.
- Verify patched systems report vendor-supported fixed Node.js packages or runtime builds.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-444: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-35256 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N3.92.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://hackerone.com/reports/1675191CVE reference
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdfCVE reference
- DSA-5326CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.