← CVE Intelligence

CVE-2024-27982

NodeJS / Node PUBLISHED

Description (CNA)

The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.

Affected (CNA)

Vendor / productVersions
NodeJS / Nodeaffected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.*; affected 13.0 before 13.*; affected 14.0 before 14.*; affected 15.0 before 15.*; affected 16.0 before 16.*; affected 17.0 before 17.*; affected 18.0 before 18.20.1; affected 19.0 before 19.*; affected 20.0 before 20.12.1; affected 21.0 before 21.7.2

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.