{
  "cveId": "CVE-2020-8201",
  "url": "https://patchblox.com/security/cve/CVE-2020-8201",
  "summary": "CVE-2020-8201 is fixed in 8 products on 2 platforms, first by Node.js 14 14.11.0, released September 15, 2020. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Node.js 14: HTTP Request Smuggling (CWE-444)",
  "description": "Node.js \u003C 12.18.4 and \u003C 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.",
  "published": "2020-09-18T21:15:12Z",
  "severity": "Moderate",
  "cvss": 7.4,
  "cwe": "CWE-444: HTTP Request Smuggling (CWE-444)",
  "epss": 0.05299,
  "epssPercentile": 0.92631,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Node.js 14",
      "fixedVersion": "14.11.0",
      "fix": "Node.js 14 14.11.0",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.14-14.11.0",
      "released": "2020-09-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs",
      "release": "RHEL 8",
      "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B8361\u002B192e434e",
      "fix": "RHSA-2020:4272",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2020-4272",
      "released": "2020-10-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs",
      "release": "ol 8",
      "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B7806\u002B0b44ae23",
      "fix": "ELSA-2020-4272",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272",
      "released": "2020-10-20T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-devel",
      "release": "RHEL 8",
      "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B8361\u002B192e434e",
      "fix": "RHSA-2020:4272",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2020-4272",
      "released": "2020-10-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-devel",
      "release": "ol 8",
      "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B7806\u002B0b44ae23",
      "fix": "ELSA-2020-4272",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272",
      "released": "2020-10-20T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-docs",
      "release": "RHEL 8",
      "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B8361\u002B192e434e",
      "fix": "RHSA-2020:4272",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2020-4272",
      "released": "2020-10-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-docs",
      "release": "ol 8",
      "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B7806\u002B0b44ae23",
      "fix": "ELSA-2020-4272",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272",
      "released": "2020-10-20T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-full-i18n",
      "release": "RHEL 8",
      "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B8361\u002B192e434e",
      "fix": "RHSA-2020:4272",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2020-4272",
      "released": "2020-10-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-full-i18n",
      "release": "ol 8",
      "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B7806\u002B0b44ae23",
      "fix": "ELSA-2020-4272",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272",
      "released": "2020-10-20T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-nodemon",
      "release": "RHEL 8",
      "fixedVersion": "0:1.18.3-1.module\u002Bel8.1.0\u002B3369\u002B37ae6a45",
      "fix": "RHSA-2020:4272",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2020-4272",
      "released": "2020-10-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-nodemon",
      "release": "ol 8",
      "fixedVersion": "0:1.18.3-1.module\u002Bel8.1.0\u002B5393\u002Baaf413e3",
      "fix": "ELSA-2020-4272",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272",
      "released": "2020-10-20T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-packaging",
      "release": "RHEL 8",
      "fixedVersion": "0:17-3.module\u002Bel8.1.0\u002B3369\u002B37ae6a45",
      "fix": "RHSA-2020:4272",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2020-4272",
      "released": "2020-10-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-packaging",
      "release": "ol 8",
      "fixedVersion": "0:17-3.module\u002Bel8.1.0\u002B5393\u002Baaf413e3",
      "fix": "ELSA-2020-4272",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272",
      "released": "2020-10-20T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "npm",
      "release": "RHEL 8",
      "fixedVersion": "1:6.14.6-1.12.18.4.2.module\u002Bel8.2.0\u002B8361\u002B192e434e",
      "fix": "RHSA-2020:4272",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2020-4272",
      "released": "2020-10-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "npm",
      "release": "ol 8",
      "fixedVersion": "1:6.14.6-1.12.18.4.2.module\u002Bel8.2.0\u002B7806\u002B0b44ae23",
      "fix": "ELSA-2020-4272",
      "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272",
      "released": "2020-10-20T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}