The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libs | May 13, 2024 | May 7, 2024 |
| Alpine Linux | — | Upgrade nodejsUpgrade llhttpUpgrade nodejs-current | Jun 6, 2024 | May 7, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs20-docsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-npmUpgrade v8-11.3-develUpgrade nodejs-libsUpgrade nodejs20-npmUpgrade nodejsUpgrade nodejs20-develUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-libsUpgrade nodejs20-debugsourceUpgrade v8-10.2-develUpgrade nodejs-debugsourceUpgrade nodejs20-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs20Upgrade nodejs20-debuginfo | Feb 17, 2025 | Apr 3, 2024 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 7, 2024 |
| Debian | — | Upgrade nodejs | Sep 16, 2024 | May 7, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | May 7, 2024 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npm | May 9, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-libs-debuginfoNo solution existsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade npm | May 13, 2024 | May 7, 2024 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npm | May 13, 2024 | May 7, 2024 |
| Suse | — | Upgrade nodejs20Upgrade nodejs12-docsUpgrade npm20Upgrade nodejs14-docsUpgrade nodejs18Upgrade nodejs18-docsUpgrade nodejs18-develUpgrade corepack18Upgrade nodejs20-docsUpgrade nodejs16-develUpgrade npm12Upgrade nodejs16Upgrade nodejs14Upgrade npm16Upgrade nodejs20-develUpgrade nodejs12-develUpgrade npm14Upgrade npm18Upgrade nodejs14-develUpgrade nodejs16-docsUpgrade nodejs12Upgrade corepack20 | Apr 17, 2024 | Apr 16, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 7, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub