CVE-2024-27982
Node.js 18 and 2 others: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVE-2024-27982 is fixed in 27 products on 2 platforms, first by Node.js 18 18.20.1, released April 2, 2024. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 2 platforms
CVSS
7.5
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0116
67th percentile
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 18 | 18.20.1 | Node.js 18 18.20.1 | Apr 2, 2024 |
| Node.js 20 | 20.12.1 | Node.js 20 20.12.1 | Apr 3, 2024 |
| Node.js 21 | 21.7.2 | Node.js 21 21.7.2 | Apr 3, 2024 |
| Linux | |||
| nodejs · Debian 12.15 (bookworm) | 18.20.4+dfsg-1~deb12u1 | DEBIAN-CVE-2024-27982 | May 7, 2024 |
| nodejs · Debian 13.5 (trixie) | 18.20.1+dfsg-1 | DEBIAN-CVE-2024-27982 | May 7, 2024 |
| nodejs · Debian 14 | 18.20.1+dfsg-1 | DEBIAN-CVE-2024-27982 | May 7, 2024 |
| nodejs · RHEL 8 | 1:18.20.2-1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780 | May 9, 2024 |
| nodejs · RHEL 9 | 1:16.20.2-8.el9_4 | RHSA-2024:2910 | May 20, 2024 |
| nodejs · almalinux 8 | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 | May 9, 2024 |
| nodejs · almalinux 9 | 1:16.20.2-8.el9_4 | ALSA-2024:2910 | May 20, 2024 |
| nodejs · amzn 2023 | 1:18.20.2-1.amzn2023.0.1 | ALAS2023-2024-694 | Aug 1, 2024 |
| nodejs · ol 8 | 1:18.20.2-1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780 | May 10, 2024 |
| nodejs · ol 9 | 1:18.20.2-1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2779 | May 14, 2024 |
| nodejs · rocky 8 | 1:18.20.2-1.module+el8.9.0+1803+9ac8b495 | RLSA-2024:2780 | May 9, 2024 |
| nodejs · rocky 9 | 1:16.20.2-8.el9_4 | RLSA-2024:2910 | Jun 14, 2024 |
| nodejs-debuginfo · amzn 2023 | 1:18.20.2-1.amzn2023.0.1 | ALAS2023-2024-694 | Aug 1, 2024 |
| nodejs-debugsource · amzn 2023 | 1:18.20.2-1.amzn2023.0.1 | ALAS2023-2024-694 | Aug 1, 2024 |
| nodejs-devel · RHEL 8 | 1:18.20.2-1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780 | May 9, 2024 |
| nodejs-devel · RHEL 9 | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 | RHSA-2024:2853 | May 15, 2024 |
| nodejs-devel · almalinux 8 | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 | May 9, 2024 |
| nodejs-devel · almalinux 9 | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 | May 15, 2024 |
| nodejs-devel · amzn 2023 | 1:18.20.2-1.amzn2023.0.1 | ALAS2023-2024-694 | Aug 1, 2024 |
| nodejs-devel · ol 8 | 1:18.20.2-1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-devel · ol 9 | 1:18.20.2-1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2779 | May 14, 2024 |
| nodejs-docs · RHEL 8 | 1:18.20.2-1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780 | May 9, 2024 |
| nodejs-docs · RHEL 9 | 1:16.20.2-8.el9_4 | RHSA-2024:2910 | May 20, 2024 |
| nodejs-docs · almalinux 8 | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 | May 9, 2024 |
| nodejs-docs · almalinux 9 | 1:16.20.2-8.el9_4 | ALSA-2024:2910 | May 20, 2024 |
| nodejs-docs · amzn 2023 | 1:18.20.2-1.amzn2023.0.1 | ALAS2023-2024-694 | Aug 1, 2024 |
| nodejs-docs · ol 8 | 1:18.20.2-1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-docs · ol 9 | 1:18.20.2-1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2779 | May 14, 2024 |
| nodejs-full-i18n · RHEL 8 | 1:18.20.2-1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780 | May 9, 2024 |
| nodejs-full-i18n · RHEL 9 | 1:16.20.2-8.el9_4 | RHSA-2024:2910 | May 20, 2024 |
| nodejs-full-i18n · almalinux 8 | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 | May 9, 2024 |
| nodejs-full-i18n · almalinux 9 | 1:16.20.2-8.el9_4 | ALSA-2024:2910 | May 20, 2024 |
| nodejs-full-i18n · amzn 2023 | 1:18.20.2-1.amzn2023.0.1 | ALAS2023-2024-694 | Aug 1, 2024 |
| nodejs-full-i18n · ol 8 | 1:18.20.2-1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-full-i18n · ol 9 | 1:18.20.2-1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2779 | May 14, 2024 |
| nodejs-libs · RHEL 9 | 1:16.20.2-8.el9_4 | RHSA-2024:2910 | May 20, 2024 |
| nodejs-libs · almalinux 9 | 1:16.20.2-8.el9_4 | ALSA-2024:2910 | May 20, 2024 |
| nodejs-libs · amzn 2023 | 1:18.20.2-1.amzn2023.0.1 | ALAS2023-2024-694 | Aug 1, 2024 |
| nodejs-libs · ol 9 | 1:16.20.2-8.0.1.el9_4 | ELSA-2024-2910 | May 22, 2024 |
| nodejs-libs-debuginfo · amzn 2023 | 1:18.20.2-1.amzn2023.0.1 | ALAS2023-2024-694 | Aug 1, 2024 |
| nodejs-nodemon · RHEL 8 | 0:3.0.1-1.module+el8.9.0+21190+5ebd2c33 | RHSA-2024:2780 | May 9, 2024 |
| nodejs-nodemon · RHEL 9 | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 | RHSA-2024:2853 | May 15, 2024 |
| nodejs-nodemon · almalinux 8 | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2024:2780 | May 9, 2024 |
| nodejs-nodemon · almalinux 9 | 3.0.1-1.module_el9.3.0+47+c33bc288 | ALSA-2024:2853 | May 15, 2024 |
| nodejs-nodemon · ol 8 | 0:3.0.1-1.module+el8.9.0+90157+ed89dc20 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-nodemon · ol 9 | 0:3.0.1-1.module+el9.3.0+90167+01064547 | ELSA-2024-2779 | May 14, 2024 |
| nodejs-nodemon · rocky 8 | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2780 | May 9, 2024 |
| nodejs-nodemon · rocky 9 | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 | Jun 14, 2024 |
| nodejs-npm · amzn 2023 | 1:10.5.0-1.18.20.2.1.amzn2023.0.1 | ALAS2023-2024-694 | Aug 1, 2024 |
| nodejs-packaging · RHEL 8 | 0:2021.06-4.module+el8.9.0+21190+5ebd2c33 | RHSA-2024:2780 | May 9, 2024 |
| nodejs-packaging · RHEL 9 | 0:2021.06-4.module+el9.3.0+19518+63aad52d | RHSA-2024:2853 | May 15, 2024 |
| nodejs-packaging · almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 | May 9, 2024 |
| nodejs-packaging · almalinux 9 | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 | May 15, 2024 |
| nodejs-packaging · ol 8 | 0:2021.06-4.module+el8.9.0+90157+ed89dc20 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-packaging · ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | ELSA-2024-2779 | May 14, 2024 |
| nodejs-packaging · rocky 8 | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2780 | May 9, 2024 |
| nodejs-packaging · rocky 9 | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 | Jun 14, 2024 |
| nodejs-packaging-bundler · RHEL 8 | 0:2021.06-4.module+el8.9.0+21190+5ebd2c33 | RHSA-2024:2780 | May 9, 2024 |
| nodejs-packaging-bundler · RHEL 9 | 0:2021.06-4.module+el9.3.0+19518+63aad52d | RHSA-2024:2853 | May 15, 2024 |
| nodejs-packaging-bundler · almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 | May 9, 2024 |
| nodejs-packaging-bundler · almalinux 9 | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 | May 15, 2024 |
| nodejs-packaging-bundler · ol 8 | 0:2021.06-4.module+el8.9.0+90157+ed89dc20 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-packaging-bundler · ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | ELSA-2024-2779 | May 14, 2024 |
| nodejs20 · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-debuginfo · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-debugsource · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-devel · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-docs · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-full-i18n · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-libs · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-libs-debuginfo · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-npm · amzn 2023 | 1:10.5.0-1.20.12.2.1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| npm · RHEL 8 | 1:10.5.0-1.18.20.2.1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780 | May 9, 2024 |
| npm · RHEL 9 | 1:8.19.4-1.16.20.2.8.el9_4 | RHSA-2024:2910 | May 20, 2024 |
| npm · almalinux 8 | 1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 | May 9, 2024 |
| npm · almalinux 9 | 1:8.19.4-1.16.20.2.8.el9_4 | ALSA-2024:2910 | May 20, 2024 |
| npm · ol 8 | 1:10.5.0-1.18.20.2.1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780 | May 10, 2024 |
| npm · ol 9 | 1:10.5.0-1.18.20.2.1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2779 | May 14, 2024 |
| v8-10.2-devel · amzn 2023 | 3:10.2.154.26-1.18.20.2.1.amzn2023.0.1 | ALAS2023-2024-694 | Aug 1, 2024 |
| v8-11.3-devel · amzn 2023 | 3:11.3.244.8-1.20.12.2.1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.