The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npm | May 13, 2024 | May 7, 2024 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade llhttpUpgrade nodejs | Jun 6, 2024 | May 7, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs20-npmUpgrade nodejs-libsUpgrade nodejs-npmUpgrade nodejs-libs-debuginfoUpgrade v8-11.3-develUpgrade nodejs-docsUpgrade nodejs20-docsUpgrade nodejs20-libsUpgrade nodejs20-develUpgrade nodejs20-debuginfoUpgrade nodejs20-debugsourceUpgrade nodejs20-full-i18nUpgrade nodejs20Upgrade nodejsUpgrade nodejs20-libs-debuginfoUpgrade v8-10.2-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfo | Feb 17, 2025 | Apr 3, 2024 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 7, 2024 |
| Debian | — | Upgrade nodejs | Sep 16, 2024 | May 7, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | May 7, 2024 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18n | May 9, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-debuginfoNo solution existsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemon | May 13, 2024 | May 7, 2024 |
| Rocky_linux | — | Upgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs | May 13, 2024 | May 7, 2024 |
| Suse | — | Upgrade npm12Upgrade npm20Upgrade nodejs18-develUpgrade nodejs12-docsUpgrade nodejs18-docsUpgrade corepack18Upgrade nodejs18Upgrade nodejs14-docsUpgrade nodejs20Upgrade nodejs16Upgrade nodejs20-docsUpgrade nodejs16-develUpgrade nodejs14Upgrade nodejs12-develUpgrade nodejs20-develUpgrade corepack20Upgrade npm18Upgrade nodejs12Upgrade nodejs14-develUpgrade npm16Upgrade npm14Upgrade nodejs16-docs | Apr 17, 2024 | Apr 16, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 7, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub