The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-devel | May 13, 2024 | May 7, 2024 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejsUpgrade llhttp | Jun 6, 2024 | May 7, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs20-develUpgrade v8-10.2-develUpgrade nodejs20-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs20-full-i18nUpgrade nodejs20-debugsourceUpgrade nodejs20-libsUpgrade nodejs20Upgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs20-npmUpgrade v8-11.3-develUpgrade nodejs20-docsUpgrade nodejs-docsUpgrade nodejs-npmUpgrade nodejs-libsUpgrade nodejs-full-i18n | Feb 17, 2025 | Apr 3, 2024 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 7, 2024 |
| Debian | — | Upgrade nodejs | Sep 16, 2024 | May 7, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | May 7, 2024 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-docsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-libs | May 9, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-libs-debuginfoNo solution existsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-libsUpgrade nodejs | May 13, 2024 | May 7, 2024 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs | May 13, 2024 | May 7, 2024 |
| Suse | — | Upgrade npm12Upgrade npm20Upgrade nodejs18Upgrade nodejs18-develUpgrade nodejs16-develUpgrade nodejs14-docsUpgrade corepack18Upgrade nodejs12-docsUpgrade nodejs18-docsUpgrade nodejs20Upgrade nodejs14Upgrade nodejs20-docsUpgrade nodejs16Upgrade corepack20Upgrade nodejs14-develUpgrade nodejs20-develUpgrade npm18Upgrade npm16Upgrade nodejs12Upgrade nodejs12-develUpgrade nodejs16-docsUpgrade npm14 | Apr 17, 2024 | Apr 16, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 7, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub