CVE-2024-27982

CWE-444 — HTTP Request Smuggling7 documents7 sources
Severity
6.5MEDIUM
EPSS
0.4%
top 39.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Nodejs Node
Timeline
PublishedMay 7
Latest updateMay 14

Description

The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LExploitability: 3.9 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5nodejs/node4.0 — 4.*+17
▶Debiannodejs< 12.22.12~dfsg-1~deb11u5+3

🔴Vulnerability Details

3
OSV
CVE-2024-27982: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP reque↗2024-05-07
▶
CVEList
CVE-2024-27982: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP reque↗2024-05-07
▶
GHSA
GHSA-hg6j-8h7m-3w3j: The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP reque↗2024-05-07
▶

📋Vendor Advisories

3
Microsoft
The team has identified a critical vulnerability in the http server of the most recent version of Node where malformed headers can lead to HTTP request smuggling. Specifically if a space is placed bef↗2024-05-14
▶
Red Hat
nodejs: HTTP Request Smuggling via Content Length Obfuscation↗2024-04-03
▶
Debian
CVE-2024-27982: nodejs - The team has identified a critical vulnerability in the http server of the most ...↗2024
▶
CVE-2024-27982 (MEDIUM CVSS 6.5) | The team has identified a critical | cvebase.io