HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Feb 7, 2020 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Aug 22, 2024 | Feb 7, 2020 |
| Amazon Linux Ami 2 | — | Upgrade http-parser-develUpgrade http-parserUpgrade http-parser-debuginfo | May 8, 2020 | Feb 7, 2020 |
| Amazon_linux | — | Upgrade http-parser | Apr 24, 2020 | Feb 7, 2020 |
| Centos_linux | — | Upgrade nodejsUpgrade http-parser-debuginfoUpgrade http-parser-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-devel-debuginfoUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade http-parser-debugsourceUpgrade http-parser | Feb 26, 2020 | Feb 7, 2020 |
| Debian | — | Upgrade nodejsUpgrade http-parser | May 1, 2020 | Feb 7, 2020 |
| Freebsd | — | Upgrade node12Upgrade nodeUpgrade node10 | Mar 10, 2020 | Mar 9, 2020 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Feb 7, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-10 to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade runtime/nodejs to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Feb 7, 2020 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejsUpgrade http-parser-develUpgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade http-parser | Mar 2, 2020 | Feb 7, 2020 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade http-parser-develUpgrade nodejs-docsUpgrade npmUpgrade http-parser-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade http-parserUpgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade nodejs-packagingUpgrade http-parser-debugsource | Feb 26, 2020 | Feb 7, 2020 |
| Rocky_linux | — | — | Aug 15, 2024 | Feb 7, 2020 |
| Suse | — | Upgrade nodejs6-docsUpgrade nodejs10Upgrade nodejs12-docsUpgrade nodejs10-develUpgrade nodejs12-develUpgrade nodejs6Upgrade npm10Upgrade nodejs12Upgrade npm8Upgrade nodejs8Upgrade nodejs10-docsUpgrade nodejs8-docsUpgrade nodejs6-develUpgrade npm6Upgrade npm12Upgrade nodejs8-devel | Mar 3, 2020 | Feb 7, 2020 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode-devUpgrade nodejsUpgrade libnode64Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro) | Sep 20, 2023 | Feb 7, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub