HTTP Request Smuggling Vulnerability in Node.js Package - CVE-2021-22959
Summary
UBUNTU-CVE-2021-22959: The parser in accepts requests with a space (SP) right after the header name before the colon. Affects nodejs versions < 12.22.9~dfsg-1ubuntu3. Fixed in 12.22.9~dfsg-1ubuntu3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The specific version affected by this vulnerability is 12.22.9~dfsg-1ubuntu3, which includes several libraries such as libnode-dev and nodejs-doc. This version is susceptible to a flaw in the HTTP parser that can lead to serious security issues.
Vulnerability Detail
The vulnerability identified as CVE-2021-22959 arises from the HTTP parser in Node.js, which incorrectly accepts requests that contain a space (SP) immediately following the header name before the colon. This flaw can lead to HTTP Request Smuggling (HRS), allowing attackers to manipulate the way requests are processed by the server. If exploited, this could result in unauthorized access to sensitive data or the ability to bypass security controls, making it a significant risk for applications relying on this version of Node.js.
How To Fix
Minimum fixed version
12.22.9~dfsg-1ubuntu3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation on incoming HTTP requests to ensure that they conform to expected formats, thereby mitigating the risk of HTTP Request Smuggling until the package can be updated.
Conclusion
CVE-2021-22959 is a critical vulnerability in the Node.js package that can lead to HTTP Request Smuggling. It is crucial to update to the patched version to protect your application from potential exploitation. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
CVE-2021-22959 is a vulnerability in the Node.js HTTP parser that allows for HTTP Request Smuggling due to improper handling of spaces in request headers.
If exploited, this vulnerability can allow attackers to manipulate requests, potentially leading to unauthorized access to sensitive information or bypassing security measures.
The vulnerability affects Node.js version 12.22.9~dfsg-1ubuntu3 and earlier versions that utilize the llhttp parser.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-22959 is 6.5, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
