{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2018-7159 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2018-7159 is a medium-severity vulnerability in Nodejs Node.js, published on 17 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2018-7159 and fix it if it is affected.\n\nWhat it is: CVE-2018-7159 is a medium-severity vulnerability in Nodejs Node.js, published on 17 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2018-7159 in the wild and no public exploit code.\n\nAffected product: Nodejs Node.js. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2018-7159/ (Markdown: https://insights.sbomify.com/CVE-2018-7159/index.md)","id":"CVE-2018-7159","markdown":"https://insights.sbomify.com/CVE-2018-7159/index.md","name":"CVE-2018-7159","record":{"aliases":["ALPINE-CVE-2018-7159","AZL-40842","CLEANSTART-2026-OE76627","CLEANSTART-2026-QX63869","DEBIAN-CVE-2018-7159","GHSA-87vg-5pwm-8x6w","UBUNTU-CVE-2018-7159"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["other"],"network_reachable":"yes","non_default_config":false,"product_category":"Node.js HTTP parser","requires_auth":"none","summary":"Node.js HTTP parser mishandles spaces in Content-Length headers, potentially causing request smuggling or logic errors in user code.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"nodejs","cpe":[{"product":"node.js","vendor":"nodejs"}],"cvss":{"score":5.3,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-115","name":"Misinterpretation of Input"}],"description":"The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Other in Node.js","id":"CVE-2018-7159","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"nodejs:node.js","products":["nodejs:node.js"],"type":"other","year":"2018"},"n_packages":0,"n_references":3,"next":{"headline":"Server-side request forgery in Node.js","id":"CVE-2018-7160"},"packages":[],"prev":{"headline":"Denial of service in Node.js","id":"CVE-2018-7158"},"products":["Node.js"],"published":"2018-05-17","related":[{"cvss_score":9.8,"headline":"Security feature bypass in Node","id":"CVE-2023-32002","kev_date_added":null,"published":"2023-08-21"},{"cvss_score":9.8,"headline":"Integer overflow in n/a","id":"CVE-2016-6303","kev_date_added":null,"published":"2016-09-16"},{"cvss_score":9.1,"headline":"Security feature bypass in Node.js","id":"CVE-2017-15896","kev_date_added":null,"published":"2017-12-11"},{"cvss_score":8.8,"headline":"Server-side request forgery in Node.js","id":"CVE-2018-7160","kev_date_added":null,"published":"2018-05-17"},{"cvss_score":8.1,"headline":"Misconfiguration in Node.js","id":"CVE-2018-12120","kev_date_added":null,"published":"2018-11-28"},{"cvss_score":7.9,"headline":"Path traversal in Node","id":"CVE-2024-21891","kev_date_added":null,"published":"2024-02-20"},{"cvss_score":7.9,"headline":"Path traversal in Node","id":"CVE-2024-21896","kev_date_added":null,"published":"2024-02-20"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-08","vendors":["The Node.js Project"]},"summary":"Node.js HTTP parser mishandles spaces in Content-Length headers, potentially causing request smuggling or logic errors in user code.","url":"https://insights.sbomify.com/CVE-2018-7159/"}