The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-devel | May 13, 2024 | May 7, 2024 |
| Alpine Linux | — | Upgrade llhttpUpgrade nodejsUpgrade nodejs-current | Jun 6, 2024 | May 7, 2024 |
| Amazon_linux_2023 | — | Upgrade v8-10.2-develUpgrade nodejs20-libs-debuginfoUpgrade nodejs20Upgrade nodejs20-debuginfoUpgrade nodejs20-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs20-full-i18nUpgrade nodejs20-develUpgrade nodejsUpgrade nodejs20-libsUpgrade nodejs-debugsourceUpgrade nodejs20-docsUpgrade nodejs-npmUpgrade nodejs-libs-debuginfoUpgrade v8-11.3-develUpgrade nodejs-docsUpgrade nodejs20-npmUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-devel | Feb 17, 2025 | Apr 3, 2024 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 7, 2024 |
| Debian | — | Upgrade nodejs | Sep 16, 2024 | May 7, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | May 7, 2024 |
| Oracle_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-nodemon | May 9, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-nodemonNo solution existsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs | May 13, 2024 | May 7, 2024 |
| Rocky_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18n | May 13, 2024 | May 7, 2024 |
| Suse | — | Upgrade nodejs12Upgrade nodejs14-develUpgrade npm16Upgrade corepack20Upgrade nodejs16-docsUpgrade npm14Upgrade nodejs20-develUpgrade npm18Upgrade nodejs12-develUpgrade nodejs18-develUpgrade nodejs12-docsUpgrade nodejs14-docsUpgrade nodejs14Upgrade nodejs16-develUpgrade nodejs20Upgrade nodejs20-docsUpgrade nodejs16Upgrade nodejs18-docsUpgrade npm20Upgrade npm12Upgrade nodejs18Upgrade corepack18 | Apr 17, 2024 | Apr 16, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 7, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub