Every CVE Search/ Get API key

CVE-2020-8201

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver...

7.4 HighFix available

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

5.30%Up 3.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.4

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Record
CVE-2020-8201
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-444
Updated
2026-11-02
CVE List No score

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Record
CVE-2020-8201
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2020-29078 No score

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Record
EUVD-2020-29078
Updated
2026-11-02
GitHub AdvisoriesGHSA-7mcp-gwc2-4c6m 7.4

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver...

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Record
GHSA-7mcp-gwc2-4c6m
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-444
Updated
2026-11-02
OSVALPINE-CVE-2020-8201 7.4

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Record
ALPINE-CVE-2020-8201
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
OSVBELL-CVE-2020-8201 7.4

CVE-2020-8201 does not affect BellSoft software

Record
BELL-CVE-2020-8201
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 14 moreShow less
OSV 7.4

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Record
CVE-2020-8201
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-8201 7.4

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Record
DEBIAN-CVE-2020-8201
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2020:4272 7.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2020:4272
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4903 7.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2020:4903
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:5086 7.8

Red Hat Security Advisory: rh-nodejs12-nodejs security update

Record
RHSA-2020:5086
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2020:4272 7.8

Moderate: nodejs:12 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

Security Fix(es):

  • nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  • nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

  • npm: Sensitive information exposure through logs (CVE-2020-15095)

  • libuv: buffer overflow in realpath (CVE-2020-8252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • The nodejs:12/development module is not installable (BZ#1883966)
Record
RLSA-2020:4272
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-8201 7.4

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Record
UBUNTU-CVE-2020-8201
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVALSA-2020:4272 No score

Moderate: nodejs:12 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

Security Fix(es):

  • nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  • nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

  • npm: Sensitive information exposure through logs (CVE-2020-15095)

  • libuv: buffer overflow in realpath (CVE-2020-8252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • The nodejs:12/development module is not installable (BZ#1883966)
Record
ALSA-2020:4272
Updated
2026-11-02
OSVBIT-node-2020-8201 No score

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Record
BIT-node-2020-8201
Updated
2026-11-02
OSVBIT-node-min-2020-8201 No score

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Record
BIT-node-min-2020-8201
Updated
2026-11-02
OSVopenSUSE-SU-2020:1616-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • nodejs12 was updated to 12.18.4 LTS:
    • CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).
    • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
    • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
  • Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2020:1616-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11096-1 No score

nodejs14-14.17.5-1.2 on GA media

These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11096-1
Updated
2026-11-02
OSVSUSE-SU-2020:2812-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • nodejs12 was updated to 12.18.4 LTS:
    • CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).
    • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
    • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
  • Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)
Record
SUSE-SU-2020:2812-1
Updated
2026-11-02
OSVSUSE-SU-2020:2813-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • nodejs12 was updated to 12.18.4 LTS:
    • CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).
    • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
    • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
  • Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)
Record
SUSE-SU-2020:2813-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.11
 before 12.20.1-r0
12.20.1-r0
nodejs
Alpine:v3.12
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.13
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.14
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.15
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.16
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.17
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.18
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.19
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.20
 before 12.18.4-r0
12.18.4-r0
Show 55 moreShow less
Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.21
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.22
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.23
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.24
 before 12.18.4-r0
12.18.4-r0
nodejs-current
Alpine:v3.13
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.14
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.15
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.16
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.17
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.18
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.19
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.20
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.21
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.22
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.23
 before 14.11.0-r0
14.11.0-r0
nodejs-current
Alpine:v3.24
 before 14.11.0-r0
14.11.0-r0
nodejs-nodemon
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.18.3-1.module_el8.3.0+2023+d2377ea3
1.18.3-1.module_el8.3.0+2023+d2377ea3
nodejs-nodemon
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.18.3-1.module_el8.3.0+2047+b07ac28e
1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 4 CVEs
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 4 CVEs
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 4 CVEs
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
node
Bitnami
 12.0.0 up to 12.18.4, 14.0.0 up to 14.11.0
12.18.414.11.0
node-min
Bitnami
 12.0.0 up to 12.18.4, 14.0.0 up to 14.11.0
12.18.414.11.0
nodejs
Debian:12
 before 12.18.4~dfsg-1
12.18.4~dfsg-1
nodejs
Debian:13
 before 12.18.4~dfsg-1
12.18.4~dfsg-1
nodejs
Debian:14
 before 12.18.4~dfsg-1
12.18.4~dfsg-1
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e
1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e
nodejs
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-debuginfo
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-debugsource
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-devel
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-docs
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-full-i18n
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-nodemon
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500
1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.18.4-3.el7
0:12.18.4-3.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.18.4-3.el7
0:12.18.4-3.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.18.4-3.el7
0:12.18.4-3.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.18.4-3.el7
0:12.18.4-3.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:6.14.6-12.18.4.3.el7
0:6.14.6-12.18.4.3.el7
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:1.18.3-1.module+el8.3.0+101+f84c7154
0:1.18.3-1.module+el8.3.0+101+f84c7154
nodejs-packaging
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 3 CVEs
 before 12.18.4-1.20.1
12.18.4-1.20.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 3 CVEs
 before 12.18.4-4.6.1
12.18.4-4.6.1
nodejs12
openSUSE:Leap 15.2
From an advisory covering 3 CVEs
 before 12.18.4-lp152.3.6.1
12.18.4-lp152.3.6.1
nodejs14
openSUSE:Tumbleweed
From an advisory covering 19 CVEs
 before 14.17.5-1.2
14.17.5-1.2

History

History
RecordedChangedSources
affected, facts
affectedOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-8201 is a high vulnerability (CVSS 7.4) in Nodejs Node, published September 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.30%, the 92nd percentile. Fixed in nodejs 12.20.1-r0.

References

Show 70 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open