logo

Database

HTTP request smuggling In nodejs

Description

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 29

10

Aliases

1. CVE-2019-156052. NVD-2019-156053. OSV-DEBIAN-2019-156054. OSV-2019-156055. OSV-ALPINE-2019-156056. GCVE-2019-156057. SECURITY-TRACKER-CVE-2019-156058. SECURITY-CVE-2019-156059. lists.opensuse.org10. access.redhat.com11. access.redhat.com12. access.redhat.com13. access.redhat.com14. access.redhat.com15. access.redhat.com16. access.redhat.com17. access.redhat.com18. nodejs.org19. nodejs.org20. nodejs.org21. nodejs.org22. security.gentoo.org23. security.netapp.com24. DEBIAN-dsa-4669

References

1. https://github.com/0-9194/node-poc-http-smuggling2. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CT3WTR4P5VAJ3GJGKPYEDUPTNZ3IEDUR/3. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLB676PDU4RJQLWQUA277YNGYYNEYGWO/4. https://hackerone.com/reports/7357485. https://www.oracle.com//security-alerts/cpujul2021.html6. https://www.oracle.com/security-alerts/cpuapr2020.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.