CVE-2024-27982

MEDIUM

Node < 18.20.1, 19.x, < 20.12.1, < 21.7.2 - HTTP Request Smuggling via Malformed Content-Length Header

Title source: llm
STIX 2.1

Description

The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.

References (6)

Core 6

Scores

CVSS v3 6.5
EPSS 0.0115
EPSS Percentile 62.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-444
Status published
Products (18)
NodeJS/Node 10.0 - 10.*
NodeJS/Node 11.0 - 11.*
NodeJS/Node 12.0 - 12.*
NodeJS/Node 13.0 - 13.*
NodeJS/Node 14.0 - 14.*
NodeJS/Node 15.0 - 15.*
NodeJS/Node 16.0 - 16.*
NodeJS/Node 17.0 - 17.*
NodeJS/Node 18.0 - 18.20.1
NodeJS/Node 19.0 - 19.*
... and 8 more
Published May 07, 2024
Tracked Since Feb 18, 2026