CVE-2020-8201
Fixed in a distro release EPSS 5%
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2047+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| Alpine 3.11 | nodejs | 12.20.1-r0 |
| Alpine 3.12 | nodejs | 12.18.4-r0 |
| Alpine 3.13 | nodejs | 12.18.4-r0 |
| Alpine 3.14 | nodejs | 12.18.4-r0 |
| Alpine 3.15 | nodejs | 12.18.4-r0 |
| Alpine 3.16 | nodejs | 12.18.4-r0 |
| Alpine 3.17 | nodejs | 12.18.4-r0 |
| Alpine 3.18 | nodejs | 12.18.4-r0 |
| Alpine 3.19 | nodejs | 12.18.4-r0 |
| Alpine 3.20 | nodejs | 12.18.4-r0 |
| Alpine 3.21 | nodejs | 12.18.4-r0 |
| Alpine 3.22 | nodejs | 12.18.4-r0 |
| Alpine 3.23 | nodejs | 12.18.4-r0 |
| Alpine 3.24 | nodejs | 12.18.4-r0 |
| Debian 12 | nodejs | 12.18.4~dfsg-1 |
| Debian 13 | nodejs | 12.18.4~dfsg-1 |
| Debian 14 | nodejs | 12.18.4~dfsg-1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat Enterprise Linux 8 | npm | 1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e |
| Red Hat rhel eus 8.1 | nodejs | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-debuginfo | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-debugsource | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-devel | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-docs | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-full-i18n | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat rhel eus 8.1 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat rhel eus 8.1 | npm | 1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs | 0:12.18.4-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-debuginfo | 0:12.18.4-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-devel | 0:12.18.4-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-docs | 0:12.18.4-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-npm | 0:6.14.6-12.18.4.3.el7 |
| Rocky Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
| Rocky Linux 8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs12 | 12.18.4-1.20.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP2 | nodejs12 | 12.18.4-4.6.1 |
| Ubuntu 22.04 LTS | nodejs | 12.22.9~dfsg-1ubuntu3 |
| openSUSE Leap 15.2 | nodejs12 | 12.18.4-lp152.3.6.1 |
| openSUSE Tumbleweed | nodejs14 | 14.17.5-1.2 |