Node.js HTTP Parser Vulnerability - Content-Length Header Misinterpretation
Summary
ALPINE-CVE-2018-7159: The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. Affects nodejs versions < 8.11.0-r0. Fixed in 8.11.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine, designed for building scalable network applications. It allows developers to use JavaScript on the server side, enabling full-stack development with a single language. The package 'nodejs' is widely used for creating web servers and APIs. However, it has a vulnerability related to the HTTP parser that can lead to incorrect handling of the 'Content-Length' header, potentially affecting data integrity.
Vulnerability Detail
The vulnerability arises from the HTTP parser in Node.js, which incorrectly ignores spaces in the 'Content-Length' header. This allows malformed input, such as 'Content-Length: 1 2', to be interpreted as a value of '12'. While the HTTP specification does not permit spaces in this header, the flaw poses a low security risk as it is challenging to exploit in a meaningful way. However, it can lead to vulnerabilities in user code that makes incorrect assumptions about the accuracy of the 'Content-Length' value compared to the actual data length.
How To Fix
Minimum fixed version
8.11.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers are advised to re-check the length of any input supplied after parsing is complete, ensuring that the data length matches the expected value. This can be done by implementing additional validation checks in your code.
Conclusion
The Node.js HTTP parser vulnerability related to the 'Content-Length' header can lead to potential data integrity issues. It is crucial for developers to update their Node.js packages to the patched version and implement additional validation checks to mitigate risks associated with this vulnerability.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
All current versions of Node.js prior to the patch version 8.11.0-r0 are affected by this vulnerability.
While the vulnerability exists, it is considered difficult to exploit in a way that could lead to significant security issues.
If you cannot update to the patched version, ensure to implement additional validation checks on the 'Content-Length' header in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
