CVE-2024-27982

EUVD-2024-25156
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
HTTP Request/Response Smuggling
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 67%
Debian logo
Debian Releases
Debian Product
Codename
nodejs
bookworm
18.20.4+dfsg-1~deb12u1
fixed
bookworm (security)
18.20.4+dfsg-1~deb12u1
fixed
bullseye
vulnerable
bullseye (security)
12.22.12~dfsg-1~deb11u7
fixed
forky
22.21.1+dfsg+~cs22.19.0-6
fixed
sid
22.21.1+dfsg+~cs22.19.0-6
fixed
trixie
20.19.2+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nodejs
bionic
not-affected
focal
not-affected
jammy
needed
mantic
ignored
noble
needed
oracular
not-affected
plucky
not-affected
questing
not-affected
trusty
not-affected
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
nodejs12
suse enterprise server 15 SP2
12.22.12-150200.4.59.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.59.1
fixed
nodejs12-devel
suse enterprise server 15 SP2
12.22.12-150200.4.59.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.59.1
fixed
nodejs12-docs
suse enterprise server 15 SP2
12.22.12-150200.4.59.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.59.1
fixed
nodejs14
suse enterprise server 15 SP2
14.21.3-150200.15.58.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.58.1
fixed
nodejs14-devel
suse enterprise server 15 SP2
14.21.3-150200.15.58.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.58.1
fixed
nodejs14-docs
suse enterprise server 15 SP2
14.21.3-150200.15.58.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.58.1
fixed
nodejs16
suse enterprise server 15 SP3
16.20.2-150300.7.36.2
fixed
suse enterprise server 15 SP4
16.20.2-150400.3.33.1
fixed
nodejs16-devel
suse enterprise server 15 SP3
16.20.2-150300.7.36.2
fixed
suse enterprise server 15 SP4
16.20.2-150400.3.33.1
fixed
nodejs16-docs
suse enterprise server 15 SP3
16.20.2-150300.7.36.2
fixed
suse enterprise server 15 SP4
16.20.2-150400.3.33.1
fixed
nodejs18
suse enterprise sap 15 SP5
18.20.1-150400.9.21.3
fixed
suse enterprise server 15 SP4
18.20.1-150400.9.21.3
fixed
suse enterprise server 15 SP5
18.20.1-150400.9.21.3
fixed
nodejs18-devel
suse enterprise sap 15 SP5
18.20.1-150400.9.21.3
fixed
suse enterprise server 15 SP4
18.20.1-150400.9.21.3
fixed
suse enterprise server 15 SP5
18.20.1-150400.9.21.3
fixed
nodejs18-docs
suse enterprise sap 15 SP5
18.20.1-150400.9.21.3
fixed
suse enterprise server 15 SP4
18.20.1-150400.9.21.3
fixed
suse enterprise server 15 SP5
18.20.1-150400.9.21.3
fixed
nodejs20
suse enterprise sap 15 SP5
20.12.1-150500.11.9.2
fixed
suse enterprise server 15 SP5
20.12.1-150500.11.9.2
fixed
nodejs20-devel
suse enterprise sap 15 SP5
20.12.1-150500.11.9.2
fixed
suse enterprise server 15 SP5
20.12.1-150500.11.9.2
fixed
nodejs20-docs
suse enterprise sap 15 SP5
20.12.1-150500.11.9.2
fixed
suse enterprise server 15 SP5
20.12.1-150500.11.9.2
fixed
npm12
suse enterprise server 15 SP2
12.22.12-150200.4.59.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.59.1
fixed
npm14
suse enterprise server 15 SP2
14.21.3-150200.15.58.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.58.1
fixed
npm16
suse enterprise server 15 SP3
16.20.2-150300.7.36.2
fixed
suse enterprise server 15 SP4
16.20.2-150400.3.33.1
fixed
npm18
suse enterprise sap 15 SP5
18.20.1-150400.9.21.3
fixed
suse enterprise server 15 SP4
18.20.1-150400.9.21.3
fixed
suse enterprise server 15 SP5
18.20.1-150400.9.21.3
fixed
npm20
suse enterprise sap 15 SP5
20.12.1-150500.11.9.2
fixed
suse enterprise server 15 SP5
20.12.1-150500.11.9.2
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
nodejs
RHEL 9
1:16.20.2-8.el9_4
fixed
nodejs-docs
RHEL 9
1:16.20.2-8.el9_4
fixed
nodejs-full-i18n
RHEL 9
1:16.20.2-8.el9_4
fixed
nodejs-libs
RHEL 9
1:16.20.2-8.el9_4
fixed
npm
RHEL 9
1:8.19.4-1.16.20.2.8.el9_4
fixed
Common Weakness Enumeration
References
https://hackerone.com/reports/2237099
https://hackerone.com/reports/2237099
https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QJAKA33NJCI3XLQS2K36DRCUMWIFFYVU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4M5XZZONMS4DAZE3CNDFDRSB6JQCL6Y/
https://security.netapp.com/advisory/ntap-20250418-0001/