Vulnerability · Published May 7, 2024 · Assigned by hackerone
CVE-2024-27982
Medium 6.5
In plain English
A medium-severity security flaw in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)6.5Medium
Exploit odds (30 days)1.2%top 32.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:8 | nodejs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:9 | nodejs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | nodejs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:8 | nodejs-devel | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-devel | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-devel | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-devel | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:8 | nodejs-docs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:8 | nodejs-docs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:9 | nodejs-docs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-docs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-docs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:8 | nodejs-full-i18n | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-full-i18n | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-full-i18n | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-full-i18n | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-libs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 | ALSA-2024:2853 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:2779 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:2778 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 |
| AlmaLinux:8 | npm | 1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | npm | 1:10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | npm | 1:10.5.0-1.18.20.2.2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | npm | 1:10.5.0-1.20.12.2.2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| Alpine:v3.21 | llhttp | 9.2.1-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.22 | llhttp | 9.2.1-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.23 | llhttp | 9.2.1-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.24 | llhttp | 9.2.1-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.20 | nodejs | 20.12.1-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.21 | nodejs | 20.12.1-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.22 | nodejs | 20.12.1-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.23 | nodejs | 20.12.1-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.24 | nodejs | 20.12.1-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.20 | nodejs-current | 21.7.2-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.21 | nodejs-current | 21.7.2-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.22 | nodejs-current | 21.7.2-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.23 | nodejs-current | 21.7.2-r0 | ALPINE-CVE-2024-27982 |
| Alpine:v3.24 | nodejs-current | 21.7.2-r0 | ALPINE-CVE-2024-27982 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DEBIAN-CVE-2024-27982 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DSA-5991-1 |
| Debian:13 | nodejs | 18.20.1+dfsg-1 | DEBIAN-CVE-2024-27982 |
| Debian:14 | nodejs | 18.20.1+dfsg-1 | DEBIAN-CVE-2024-27982 |
| Rocky Linux:8 | nodejs | 1:20.12.2-2.module+el8.9.0+1804+2708cc21 | RLSA-2024:2778 |
| Rocky Linux:8 | nodejs | 1:18.20.2-1.module+el8.9.0+1803+9ac8b495 | RLSA-2024:2780 |
| Rocky Linux:9 | nodejs | 1:16.20.2-8.el9_4 | RLSA-2024:2910 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2778 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2780 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:2853 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2780 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2778 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:2853 |
| Ubuntu:24.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2024-27982 |
Affected products (as reported)
Weakness: CWE-444 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- https://hackerone.com/reports/2237099
- https://security.netapp.com/advisory/ntap-20250418-0001/
- https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QJAKA33NJCI3XLQS2K36DRCUMWIFFYVU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4M5XZZONMS4DAZE3CNDFDRSB6JQCL6Y/