CVE-2024-27982

Summary

The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.

Affected Software

VendorProductVersion RangeStatus
NodeJSNode4.0 < 4.*affected
NodeJSNode5.0 < 5.*affected
NodeJSNode6.0 < 6.*affected
NodeJSNode7.0 < 7.*affected
NodeJSNode8.0 < 8.*affected
NodeJSNode9.0 < 9.*affected
NodeJSNode10.0 < 10.*affected
NodeJSNode11.0 < 11.*affected
NodeJSNode12.0 < 12.*affected
NodeJSNode13.0 < 13.*affected
NodeJSNode14.0 < 14.*affected
NodeJSNode15.0 < 15.*affected
NodeJSNode16.0 < 16.*affected
NodeJSNode17.0 < 17.*affected
NodeJSNode18.0 < 18.20.1affected
NodeJSNode19.0 < 19.*affected
NodeJSNode20.0 < 20.12.1affected
NodeJSNode21.0 < 21.7.2affected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

CVE Program Container

Additional References

References