What’s Vulnerable › Vulnerabilities

CVE-2020-8287

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 16.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-01-06 · updated 2026-06-17
• Weakness: CWE-444

Description

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

Affected products

• Debian Linux: 10.0
• Fedoraproject Fedora: 32, 33
• Node.js: from 10.0.0 before 10.23.1; from 12.0.0 before 12.20.1; from 14.0.0 before 14.15.4; from 15.0.0 before 15.5.1 — fixed in 10.23.1, 12.20.1, 14.15.4, 15.5.1
• Oracle Corporation GraalVM Enterprise Edition: 19.3.4, 20.3.0
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1

How to fix

Upgrade to a fixed version: Node.js 10.23.1, 12.20.1, 14.15.4, 15.5.1; Siemens Sinec Infrastructure Network Services 1.0.1.1. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://hackerone.com/reports/1002188
• https://lists.debian.org/debian-lts-announce/2022/12/msg00009.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/
• https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
• https://security.gentoo.org/glsa/202101-07
• https://security.netapp.com/advisory/ntap-20210212-0003/
• https://www.debian.org/security/2021/dsa-4826
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://hackerone.com/reports/1002188

Get alerted when CVE-2020-8287 or the next vulnerability affects your stack