The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-devel | May 13, 2024 | May 7, 2024 |
| Alpine Linux | — | Upgrade llhttpUpgrade nodejsUpgrade nodejs-current | Jun 6, 2024 | May 7, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-npmUpgrade v8-11.3-develUpgrade nodejs20-npmUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs20-docsUpgrade nodejs20-libsUpgrade v8-10.2-develUpgrade nodejs20-debuginfoUpgrade nodejs20-develUpgrade nodejs20Upgrade nodejs20-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs20-debugsource | Feb 17, 2025 | Apr 3, 2024 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 7, 2024 |
| Debian | — | Upgrade nodejs | Sep 16, 2024 | May 7, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | May 7, 2024 |
| Oracle_linux | — | Upgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-docs | May 9, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade nodejs-debuginfoNo solution existsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs-full-i18n | May 13, 2024 | May 7, 2024 |
| Rocky_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18n | May 13, 2024 | May 7, 2024 |
| Suse | — | Upgrade npm18Upgrade nodejs16-docsUpgrade npm14Upgrade nodejs12-develUpgrade npm16Upgrade nodejs12Upgrade nodejs14-develUpgrade nodejs20-develUpgrade corepack20Upgrade nodejs20-docsUpgrade npm12Upgrade nodejs18Upgrade nodejs16Upgrade npm20Upgrade nodejs18-develUpgrade nodejs14Upgrade nodejs14-docsUpgrade nodejs16-develUpgrade nodejs20Upgrade corepack18Upgrade nodejs18-docsUpgrade nodejs12-docs | Apr 17, 2024 | Apr 16, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 7, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub