CVE-2020-8287CWE-444

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header…

published January 6, 2021

CVSS
—
EPSS
16%
Percentile
97.0
In the wild
Unconfirmed
What it is

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.16296 · 97.0th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2021-01-06T00:00Z
EPSS history
Timeline
  • 06 JAN 00:00Z
    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header…
    cvelistv5