HTTP Request Smuggling in Node.js
Summary
CVE-2020-8287: Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). Affects nodejs across 2 version ranges.
< 12.20.1-r0
>= cf41627411886000429bde058a6594fb7f6d6d47, < 811be91dfe623c7569f5fd87b1eaf46074334c94
Fixed in 12.20.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications. However, Node.js versions before 10.23.1, 12.20.1, 14.15.4, and 15.5.1 are vulnerable to HTTP Request Smuggling.
Vulnerability Detail
HTTP Request Smuggling occurs when an attacker sends a specially crafted HTTP request that tricks the server into interpreting it differently than the client. In the case of Node.js, if a request contains two copies of a header field (e.g., two Transfer-Encoding header fields), Node.js identifies the first header field and ignores the second. This can lead to an attacker smuggling malicious requests or bypassing security measures.
How To Fix
Minimum fixed version
12.20.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed versions of Node.js to mitigate the risk.
Conclusion
HTTP Request Smuggling is a critical vulnerability in Node.js versions before 10.23.1, 12.20.1, 14.15.4, and 15.5.1. It allows attackers to manipulate HTTP requests and potentially bypass security measures. To mitigate this risk, it is crucial to update Node.js to the fixed versions mentioned. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
HTTP Request Smuggling is a technique where an attacker manipulates the HTTP request to bypass security measures or perform malicious actions.
This vulnerability can allow an attacker to smuggle malicious requests, bypass security measures, or perform unauthorized actions on the server.
Node.js versions before 10.23.1, 12.20.1, 14.15.4, and 15.5.1 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to update to the fixed versions of Node.js.
To update Node.js, follow the official documentation provided by the Node.js project. Install versions 10.23.1, 12.20.1, 14.15.4, or 15.5.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
