Critical HTTP Request Smuggling Vulnerability in Node.js Package
Summary
UBUNTU-CVE-2024-27982: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Affects nodejs versions 12.22.5~dfsg-5ubuntu1 – 12.22.9~dfsg-1ubuntu3.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications and is widely used for server-side programming. The affected versions of Node.js, specifically 12.22.9 and 18.19.1, have been identified to contain a critical vulnerability that can lead to HTTP request smuggling, posing a significant security risk to applications relying on these versions.
Vulnerability Detail
The vulnerability arises from the improper handling of malformed headers in the HTTP server of Node.js. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, allowing attackers to smuggle a second request within the body of the first. This can lead to unauthorized actions being executed on the server, potentially compromising sensitive data and application integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement input validation to sanitize headers before processing requests. This can help mitigate the risk of HTTP request smuggling until the package is updated.
Conclusion
The identified vulnerability in Node.js poses a critical risk to applications using the affected versions. It is crucial for developers and system administrators to update their Node.js installations to the latest patched versions to ensure the security and integrity of their applications. Implementing input validation can serve as a temporary measure while updates are applied.
See every vulnerability recorded for nodejs →
FAQ
HTTP request smuggling is a technique used by attackers to send multiple HTTP requests in a single request, which can lead to unauthorized actions on the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The affected versions are Node.js 12.22.9 and 18.19.1. Users should upgrade to patched versions to mitigate the risk.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and the execution of malicious requests on the server.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
