CVE-2024-27982 Other in Node
Attackers can exploit HTTP request smuggling in Node.js by using malformed headers with spaces, potentially bypassing security controls or accessing unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27982?
CVE-2024-27982 is a medium-severity vulnerability in NodeJS Node, published on 7 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
Weakness: CWE-444
Which versions are affected by CVE-2024-27982?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 18.20.1, 20.12.1, 21.7.2 |
node-min Bitnami | All versions | 18.20.1, 20.12.1, 21.7.2 |
How do I fix CVE-2024-27982?
Upgrade node to a fixed version for your release line: 18.20.1, 20.12.1 or 21.7.2.
Is CVE-2024-27982 being exploited?
There is no known exploitation of CVE-2024-27982 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-27982, AZL-40349, AZL-40352, BELL-CVE-2024-27982, BIT-node-2024-27982, BIT-node-min-2024-27982 and 6 more.