HTTP Request Smuggling Vulnerability in Node.js and http-parser Package
Summary
UBUNTU-CVE-2020-8287: Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). Affects http-parser versions 2.1-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine, designed for building scalable network applications. The http-parser package is a library used by Node.js to parse HTTP requests and responses. This package is crucial for handling HTTP communications in applications. The vulnerability in question affects multiple versions of Node.js and the http-parser package, allowing for potential security risks in applications that rely on these components.
Vulnerability Detail
Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, and 15.5.1 are susceptible to a vulnerability that allows two copies of a header field in an HTTP request. For instance, having two Transfer-Encoding header fields can lead to HTTP Request Smuggling, where the server may process the first header while ignoring the second. This can result in unexpected behavior, including the potential for malicious exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your application does not accept multiple instances of the same header field in HTTP requests. Implement validation checks in your application code to reject such requests.
Conclusion
The vulnerability in Node.js and the http-parser package poses significant risks to applications relying on these components. It is crucial to update to the latest patched versions and implement necessary validation checks to mitigate potential threats.
See every vulnerability recorded for http-parser →
FAQ
HTTP Request Smuggling is a technique that exploits inconsistencies in the way different servers interpret HTTP requests, allowing an attacker to send malicious requests that can bypass security measures.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access, data leakage, or even remote code execution, depending on the application architecture.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
The CVSS score for this vulnerability is 6.5, indicating a medium level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for http-parser.
