CVE-2024-27982
Fixed in a distro release EPSS 1%CVSS 6.5
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
Products: NodeJS Node, nodejs node.js
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 |
| AlmaLinux 8 | nodejs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux 8 | nodejs-devel | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux 8 | nodejs-devel | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 |
| AlmaLinux 8 | nodejs-docs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux 8 | nodejs-docs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 |
| AlmaLinux 8 | nodejs-full-i18n | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 |
| AlmaLinux 8 | nodejs-full-i18n | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | npm | 1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644 |
| AlmaLinux 8 | npm | 1:10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux 9 | nodejs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 |
| AlmaLinux 9 | nodejs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 |
| AlmaLinux 9 | nodejs | 1:16.20.2-8.el9_4 |
| AlmaLinux 9 | nodejs-devel | 1:18.20.2-2.module_el9.4.0+99+a01f7676 |
| AlmaLinux 9 | nodejs-devel | 1:20.12.2-2.module_el9.4.0+100+71fc9528 |
| AlmaLinux 9 | nodejs-docs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 |
| AlmaLinux 9 | nodejs-docs | 1:16.20.2-8.el9_4 |
| AlmaLinux 9 | nodejs-docs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 |
| AlmaLinux 9 | nodejs-full-i18n | 1:18.20.2-2.module_el9.4.0+99+a01f7676 |
| AlmaLinux 9 | nodejs-full-i18n | 1:20.12.2-2.module_el9.4.0+100+71fc9528 |
| AlmaLinux 9 | nodejs-full-i18n | 1:16.20.2-8.el9_4 |
| AlmaLinux 9 | nodejs-libs | 1:16.20.2-8.el9_4 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 |
| AlmaLinux 9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea |
| AlmaLinux 9 | nodejs-packaging | 2021.06-4.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea |
| AlmaLinux 9 | npm | 1:10.5.0-1.18.20.2.2.module_el9.4.0+99+a01f7676 |
| AlmaLinux 9 | npm | 1:10.5.0-1.20.12.2.2.module_el9.4.0+100+71fc9528 |
| AlmaLinux 9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 |
| Alpine 3.17 | nodejs | 18.20.1-r0 |
| Alpine 3.18 | nodejs | 18.20.1-r0 |
| Alpine 3.19 | nodejs | 20.12.1-r0 |
| Alpine 3.20 | nodejs | 20.12.1-r0 |
| Alpine 3.21 | nodejs | 20.12.1-r0 |
| Alpine 3.22 | nodejs | 20.12.1-r0 |
| Alpine 3.23 | nodejs | 20.12.1-r0 |
| Alpine 3.24 | nodejs | 20.12.1-r0 |
| Chainguard | nodejs-16 | no fix |
| Chainguard | nodejs-16-doc | 16.20.2-r15 |
| Debian 11 | nodejs | 12.22.12~dfsg-1~deb11u5 |
| Debian 12 | nodejs | 18.20.4+dfsg-1~deb12u1 |
| Debian 13 | nodejs | 18.20.1+dfsg-1 |
| Debian 14 | nodejs | 18.20.1+dfsg-1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:20.12.2-2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:18.20.2-1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+21190+5ebd2c33 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+21190+5ebd2c33 |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+21190+5ebd2c33 |
| Red Hat Enterprise Linux 8 | npm | 1:10.5.0-1.20.12.2.2.module+el8.9.0+21743+0b3f1be2 |
| Red Hat Enterprise Linux 8 | npm | 1:10.5.0-1.18.20.2.1.module+el8.9.0+21767+537f34ee |
| Red Hat Enterprise Linux 9 | nodejs | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:18.20.2-2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | nodejs-libs | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-libs-debuginfo | 1:16.20.2-8.el9_4 |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0+19762+d716bf3b |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
| Red Hat Enterprise Linux 9 | npm | 1:10.5.0-1.20.12.2.2.module+el9.4.0+21731+46b5b8a7 |
| Red Hat Enterprise Linux 9 | npm | 1:10.5.0-1.18.20.2.2.module+el9.4.0+21742+692df1ea |
| Red Hat Enterprise Linux 9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 |
| Red Hat rhel eus 9.0 | nodejs | 1:16.20.2-6.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-debuginfo | 1:16.20.2-6.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-debugsource | 1:16.20.2-6.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-docs | 1:16.20.2-6.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-full-i18n | 1:16.20.2-6.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-libs | 1:16.20.2-6.el9_0 |
| Red Hat rhel eus 9.0 | nodejs-libs-debuginfo | 1:16.20.2-6.el9_0 |
| Red Hat rhel eus 9.0 | npm | 1:8.19.4-1.16.20.2.6.el9_0 |
| Red Hat rhel eus 9.2 | nodejs | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-debuginfo | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-debugsource | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-docs | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-full-i18n | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-libs | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | nodejs-libs-debuginfo | 1:16.20.2-6.el9_2.3 |
| Red Hat rhel eus 9.2 | npm | 1:8.19.4-1.16.20.2.6.el9_2.3 |
| Rocky Linux 8 | nodejs | 1:20.12.2-2.module+el8.9.0+1804+2708cc21 |
| Rocky Linux 8 | nodejs | 1:18.20.2-1.module+el8.9.0+1803+9ac8b495 |
| Rocky Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
| Rocky Linux 9 | nodejs | 1:16.20.2-8.el9_4 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d |
| SUSE Enterprise Storage 7.1 | nodejs12 | 12.22.12-150200.4.59.1 |
| SUSE Enterprise Storage 7.1 | nodejs14 | 14.21.3-150200.15.58.1 |
| SUSE Enterprise Storage 7.1 | nodejs16 | 16.20.2-150300.7.36.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | nodejs12 | 12.22.12-150200.4.59.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | nodejs14 | 14.21.3-150200.15.58.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | nodejs12 | 12.22.12-150200.4.59.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | nodejs14 | 14.21.3-150200.15.58.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | nodejs16 | 16.20.2-150300.7.36.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | nodejs16 | 16.20.2-150400.3.33.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | nodejs18 | 18.20.1-150400.9.21.3 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | nodejs16 | 16.20.2-150400.3.33.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | nodejs18 | 18.20.1-150400.9.21.3 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs16 | 16.20.2-8.42.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs18 | 18.20.1-8.21.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs18 | 18.20.1-150400.9.21.3 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs20 | 20.12.1-150500.11.9.2 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | nodejs12 | 12.22.12-150200.4.59.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | nodejs14 | 14.21.3-150200.15.58.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | nodejs12 | 12.22.12-150200.4.59.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | nodejs14 | 14.21.3-150200.15.58.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | nodejs16 | 16.20.2-150300.7.36.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | nodejs16 | 16.20.2-150400.3.33.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | nodejs18 | 18.20.1-150400.9.21.3 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | nodejs12 | 12.22.12-150200.4.59.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | nodejs14 | 14.21.3-150200.15.58.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | nodejs12 | 12.22.12-150200.4.59.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | nodejs14 | 14.21.3-150200.15.58.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | nodejs16 | 16.20.2-150300.7.36.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | nodejs16 | 16.20.2-150400.3.33.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | nodejs18 | 18.20.1-150400.9.21.3 |
| SUSE Manager Server 4.3 | nodejs16 | 16.20.2-150400.3.33.1 |
| SUSE Manager Server 4.3 | nodejs18 | 18.20.1-150400.9.21.3 |
| Ubuntu 24.04 LTS | nodejs | no fix |
| Ubuntu Pro 22.04 LTS | nodejs | no fix |
| Wolfi | nodejs-16 | no fix |
| Wolfi | nodejs-16-doc | 16.20.2-r15 |
| openSUSE Leap 15.5 | nodejs18 | 18.20.1-150400.9.21.3 |
| openSUSE Leap 15.5 | nodejs20 | 20.12.1-150500.11.9.2 |
| openSUSE Tumbleweed | nodejs20 | 20.12.1-1.1 |
| openSUSE Tumbleweed | nodejs21 | 21.7.2-1.1 |