HTTP Request Smuggling Vulnerability in Node.js Core HTTP Server

CVE-2024-27982

What is CVE-2024-27982?

A critical security flaw has been discovered in the HTTP server component of Node.js, stemming from improper handling of HTTP headers. This vulnerability occurs when a space precedes the content-length header, resulting in the misinterpretation of request lengths. As a consequence, this flaw enables attackers to execute HTTP request smuggling attacks, where a malicious user can embed a second HTTP request within the body of a legitimate first request. This can lead to severe consequences, such as unauthorized access to sensitive information, bypassing security controls, and causing disruptions in service integrity. Organizations using Node.js should take immediate measures to patch affected versions and bolster their HTTP server configurations.

References