Node.js HTTP Parser Vulnerability: CVE-2018-7159 in Node.js Packages
Summary
UBUNTU-CVE-2018-7159: The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as Content-Length: 1 2 to be interpreted as having a value of 12. Affects nodejs versions 0.10.15~dfsg1-4 – 0.10.25~dfsg2-2ubuntu1.2+esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications. The affected packages include nodejs, nodejs-dev, and nodejs-legacy, which are essential for running JavaScript on the server side. This vulnerability affects versions of Node.js across multiple Ubuntu LTS distributions, potentially impacting applications relying on accurate HTTP header parsing.
Vulnerability Detail
The vulnerability arises from the HTTP parser in Node.js, which incorrectly handles spaces in the 'Content-Length' header. This flaw allows malformed input, such as 'Content-Length: 1 2', to be interpreted as a valid length of '12'. Although the risk is considered very low, it can lead to vulnerabilities in user code that assumes the accuracy of the 'Content-Length' value, potentially causing unexpected behavior in applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, developers are advised to re-check the length of any input supplied after parsing is complete. This can be done by implementing additional validation checks in the application code to ensure that the length of the incoming data matches the expected length.
Conclusion
CVE-2018-7159 is a low-risk vulnerability affecting the HTTP parser in Node.js, which can lead to incorrect parsing of the 'Content-Length' header. It is crucial for developers to update their Node.js packages to the patched versions and implement additional validation checks to ensure application security.
See every vulnerability recorded for nodejs →
FAQ
CVE-2018-7159 is a vulnerability in the HTTP parser of Node.js that allows incorrect parsing of the 'Content-Length' header, potentially leading to unexpected behavior in applications.
If your application relies on the accuracy of the 'Content-Length' header, this vulnerability could lead to incorrect assumptions about the length of incoming data, potentially causing errors or security issues.
Versions of Node.js specified in the affected packages for Ubuntu LTS distributions are vulnerable. Check your installed version against the affected versions listed.
If immediate updates are not possible, implement additional validation checks in your application to verify the length of incoming data after parsing.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check your application against vulnerabilities using the Vulert playground without signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
