VULNERABILITY INTELLIGENCE
CVE-2020-8287
CVSS score6.5 MEDIUM
EPSS probability16.30%
CISA KEVNot currently listed
Published2021-01-06
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
Weakness classification
- support@hackerone.com: CWE-444
- nvd@nist.gov: CWE-444
Primary references
- support@hackerone.com — Patch, Third Party Advisory
- support@hackerone.com — Exploit, Issue Tracking, Third Party Advisory
- support@hackerone.com — Mailing List, Third Party Advisory
- support@hackerone.com
- support@hackerone.com
- support@hackerone.com — Patch, Vendor Advisory
- support@hackerone.com — Third Party Advisory
- support@hackerone.com — Third Party Advisory
- support@hackerone.com — Third Party Advisory
- support@hackerone.com — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory