The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | May 17, 2018 |
| Amazon Linux Ami 2 | — | Upgrade http-parser-develUpgrade http-parser-debuginfoUpgrade http-parser | Apr 27, 2020 | May 17, 2018 |
| Amazon_linux | — | Upgrade http-parser | Apr 24, 2020 | May 17, 2018 |
| Centos_linux | — | Upgrade http-parser-develUpgrade http-parserUpgrade http-parser-debuginfo | Aug 28, 2019 | May 17, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | May 17, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 19, 2018 |
| Freebsd | — | Upgrade node8Upgrade node6Upgrade node4Upgrade node | Dec 10, 2025 | Mar 28, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade http-parser | Jun 17, 2020 | May 17, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade http-parser | Nov 19, 2019 | May 17, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade http-parser | Nov 19, 2019 | May 17, 2018 |
| Oracle_linux | — | Upgrade http-parser-develUpgrade http-parser | Jul 21, 2020 | Mar 8, 2018 |
| Redhat_linux | — | Upgrade http-parser-debuginfoUpgrade http-parserUpgrade http-parser-devel | Aug 7, 2019 | May 17, 2018 |
| Suse | — | Upgrade firefox-gtk3-immodule-ximUpgrade libfirefox-gio-2_0-0Upgrade npm8Upgrade firefox-gtk3-langUpgrade firefox-gtk3-toolsUpgrade mozillafirefoxUpgrade npm10Upgrade libfirefox-gobject-2_0-0Upgrade nodejs6Upgrade libsoftokn3-32bitUpgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libcairo2Upgrade firefox-libpango-1_0-0Upgrade mozillafirefox-branding-sledUpgrade firefox-libatk-1_0-0Upgrade nodejs10-docsUpgrade libfirefox-gthread-2_0-0Upgrade nodejs8-develUpgrade nodejs10-develUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libffi4Upgrade libfirefox-glib-2_0-0Upgrade firefox-libcairo-gobject2Upgrade nodejs6-develUpgrade firefox-libffi7Upgrade firefox-glib2-toolsUpgrade firefox-libgtk-3-0Upgrade firefox-atk-langUpgrade firefox-gdk-pixbuf-langUpgrade nodejs8Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gio-branding-upstreamUpgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-dataUpgrade mozilla-nspr-develUpgrade mozillafirefox-translations-otherUpgrade mozilla-nspr-32bitUpgrade mozillafirefox-translations-commonUpgrade mozilla-nss-32bitUpgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-multipressUpgrade npm4Upgrade mozilla-nsprUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libharfbuzz0Upgrade npm6Upgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfreebl3Upgrade mozilla-nssUpgrade nodejs10Upgrade nodejs8-docsUpgrade nodejs4-develUpgrade mozilla-nss-toolsUpgrade libsoftokn3Upgrade firefox-glib2-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-immodule-thaiUpgrade nodejs6-docsUpgrade nodejs4Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs4-docs | Jun 21, 2018 | Apr 16, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 17, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub