HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Feb 7, 2020 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | Feb 7, 2020 |
| Amazon Linux Ami 2 | — | Upgrade http-parserUpgrade http-parser-develUpgrade http-parser-debuginfo | May 8, 2020 | Feb 7, 2020 |
| Amazon_linux | — | Upgrade http-parser | Apr 24, 2020 | Feb 7, 2020 |
| Centos_linux | — | Upgrade http-parser-develUpgrade http-parser-debuginfoUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejsUpgrade nodejs-nodemonUpgrade http-parser-debugsourceUpgrade http-parserUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-devel-debuginfoUpgrade nodejs-debugsource | Feb 26, 2020 | Feb 7, 2020 |
| Debian | — | Upgrade http-parserUpgrade nodejs | May 1, 2020 | Feb 7, 2020 |
| Freebsd | — | Upgrade node12Upgrade nodeUpgrade node10 | Mar 10, 2020 | Mar 9, 2020 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Feb 7, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Feb 7, 2020 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade http-parserUpgrade nodejs-docsUpgrade http-parser-develUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-devel | Mar 2, 2020 | Feb 7, 2020 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-develUpgrade http-parser-develUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade http-parser-debuginfoUpgrade http-parser-debugsourceUpgrade http-parserUpgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-packaging | Feb 26, 2020 | Feb 7, 2020 |
| Rocky_linux | — | — | Aug 15, 2024 | Feb 7, 2020 |
| Suse | — | Upgrade npm10Upgrade npm12Upgrade nodejs10-develUpgrade npm8Upgrade nodejs6-develUpgrade nodejs8-develUpgrade nodejs6Upgrade nodejs12Upgrade nodejs12-docsUpgrade nodejs8-docsUpgrade npm6Upgrade nodejs12-develUpgrade nodejs8Upgrade nodejs10-docsUpgrade nodejs10Upgrade nodejs6-docs | Mar 3, 2020 | Feb 7, 2020 |
| Ubuntu | — | Upgrade nodejsUpgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libnode64Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode-dev | Sep 20, 2023 | Feb 7, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub