HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Feb 7, 2020 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | Feb 7, 2020 |
| Amazon Linux Ami 2 | — | Upgrade http-parser-debuginfoUpgrade http-parserUpgrade http-parser-devel | May 8, 2020 | Feb 7, 2020 |
| Amazon_linux | — | Upgrade http-parser | Apr 24, 2020 | Feb 7, 2020 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade http-parserUpgrade http-parser-debugsourceUpgrade nodejs-debugsourceUpgrade nodejs-devel-debuginfoUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npmUpgrade http-parser-debuginfoUpgrade http-parser-develUpgrade nodejs | Feb 26, 2020 | Feb 7, 2020 |
| Debian | — | Upgrade http-parserUpgrade nodejs | May 1, 2020 | Feb 7, 2020 |
| Freebsd | — | Upgrade node10Upgrade node12Upgrade node | Mar 10, 2020 | Mar 9, 2020 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Feb 7, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-10 to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade runtime/nodejs to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Feb 7, 2020 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-develUpgrade http-parser-develUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-nodemonUpgrade npmUpgrade http-parser | Mar 2, 2020 | Feb 7, 2020 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade npmUpgrade http-parser-develUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejsUpgrade http-parserUpgrade http-parser-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade http-parser-debuginfoUpgrade nodejs-devel-debuginfo | Feb 26, 2020 | Feb 7, 2020 |
| Rocky_linux | — | — | Aug 15, 2024 | Feb 7, 2020 |
| Suse | — | Upgrade npm10Upgrade nodejs10-docsUpgrade nodejs12-develUpgrade nodejs12-docsUpgrade npm8Upgrade npm6Upgrade nodejs6Upgrade nodejs8-docsUpgrade nodejs12Upgrade nodejs8Upgrade nodejs10-develUpgrade npm12Upgrade nodejs6-develUpgrade nodejs8-develUpgrade nodejs10Upgrade nodejs6-docs | Mar 3, 2020 | Feb 7, 2020 |
| Ubuntu | — | Upgrade libnode64Upgrade nodejs (Ubuntu Pro)Upgrade nodejsUpgrade nodejs-legacy (Ubuntu Pro)Upgrade libnode-devUpgrade nodejs-dev (Ubuntu Pro) | Sep 20, 2023 | Feb 7, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub