The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packagingUpgrade npm | May 13, 2024 | May 7, 2024 |
| Alpine Linux | — | Upgrade nodejsUpgrade llhttpUpgrade nodejs-current | Jun 6, 2024 | May 7, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-develUpgrade nodejs20-libsUpgrade v8-10.2-develUpgrade nodejs20-full-i18nUpgrade nodejs20-debuginfoUpgrade nodejs20-debugsourceUpgrade nodejs20-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs20Upgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs20-npmUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs20-docsUpgrade v8-11.3-develUpgrade nodejs-npmUpgrade nodejs-libsUpgrade nodejs-devel | Feb 17, 2025 | Apr 3, 2024 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 7, 2024 |
| Debian | — | Upgrade nodejs | Sep 16, 2024 | May 7, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | May 7, 2024 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packaging | May 9, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-libs-debuginfoNo solution existsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-nodemon | May 13, 2024 | May 7, 2024 |
| Rocky_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade npmUpgrade nodejs-full-i18n | May 13, 2024 | May 7, 2024 |
| Suse | — | Upgrade nodejs20-develUpgrade corepack20Upgrade npm14Upgrade nodejs16-docsUpgrade nodejs14-develUpgrade npm16Upgrade nodejs12Upgrade nodejs12-develUpgrade npm18Upgrade nodejs16Upgrade nodejs20-docsUpgrade nodejs12-docsUpgrade nodejs16-develUpgrade nodejs20Upgrade nodejs18-develUpgrade nodejs18-docsUpgrade corepack18Upgrade npm12Upgrade nodejs18Upgrade nodejs14-docsUpgrade npm20Upgrade nodejs14 | Apr 17, 2024 | Apr 16, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 7, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub