{"id":"CVE-2020-8201","aliases":["ALPINE-CVE-2020-8201","ALSA-2020:4272","BELL-CVE-2020-8201","BIT-node-2020-8201","BIT-node-min-2020-8201","DEBIAN-CVE-2020-8201","EUVD-2020-29078","GHSA-7mcp-gwc2-4c6m","RHSA-2020:4272","RHSA-2020:4903","RHSA-2020:5086","RLSA-2020:4272","SUSE-SU-2020:2812-1","SUSE-SU-2020:2813-1","UBUNTU-CVE-2020-8201","openSUSE-SU-2020:1616-1","openSUSE-SU-2024:11096-1"],"status":"published","title":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver...","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05299,"percentile":0.92635,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2020-09-18T20:12:43Z","modified":"2026-11-03T06:32:26Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["12.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["12.18.4","14.11.0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["12.18.4","14.11.0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["12.18.4~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["12.18.4~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["12.18.4~dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.18.4"},{"introduced":"14.0.0"},{"fixed":"14.11.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.18.4"},{"introduced":"14.0.0"},{"fixed":"14.11.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4~dfsg-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.4-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.4-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.4-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.4-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.6-12.18.4.3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-1.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-lp152.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-1.2"}]}],"bundled":19}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://hackerone.com/reports/922597","tags":["x_refsource_MISC","x_transferred","Permissions Required","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20201009-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202101-07","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8201","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/"},{"url":"https://github.com/advisories/GHSA-7mcp-gwc2-4c6m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-8201","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4272","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1856875","tags":["report"]},{"url":"https://bugzilla.redhat.com/1868196","tags":["report"]},{"url":"https://bugzilla.redhat.com/1879311","tags":["report"]},{"url":"https://bugzilla.redhat.com/1879315","tags":["report"]},{"url":"https://bugzilla.redhat.com/1883966","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-4272.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-15095","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8116","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8201","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8252","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-8201","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8201","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879311","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879315","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883966","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4272.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8116","tags":["advisory"]},{"url":"https://hackerone.com/reports/719856","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8201","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8252","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15095","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4903","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883965","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4903.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5086","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5086.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4272","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202812-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172686","tags":["report"]},{"url":"https://bugzilla.suse.com/1173937","tags":["report"]},{"url":"https://bugzilla.suse.com/1176589","tags":["report"]},{"url":"https://bugzilla.suse.com/1176605","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8252","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202813-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8201","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/#http-request-smuggling-due-to-cr-to-hyphen-conversion-high-cve-2020-8201","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5CMPMUA4PV5TIZ4ZIY7PTL3KUZIS2IAM/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3672","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-8201","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","status":"published","published":"2020-09-18T20:12:43Z","modified":"2025-04-30T22:24:25.163Z","cwes":["CWE-444"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-29078","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","status":"published","published":"2020-09-18T20:12:43Z","modified":"2025-04-30T22:24:25Z","updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-7mcp-gwc2-4c6m","title":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver...","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","status":"published","published":"2022-05-24T17:29:12Z","modified":"2023-01-29T05:04:38Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:45:36.114986Z"}],"nvd":[{"id":"CVE-2020-8201","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","status":"published","published":"2020-09-18T21:15:12.903Z","modified":"2026-06-17T03:26:02.673Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:06:15.83396Z"}],"osv":[{"id":"ALPINE-CVE-2020-8201","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","status":"published","published":"2020-09-18T21:15:12.903Z","modified":"2026-11-03T06:32:26.524573121Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"BELL-CVE-2020-8201","title":"CVE-2020-8201 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:22.178571Z","modified":"2026-02-18T07:38:24.186779Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-8201","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","status":"published","published":"2020-09-18T21:15:12.903Z","modified":"2026-10-24T10:30:58.184322961Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8201","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","status":"published","published":"2020-09-18T21:15:12.903Z","modified":"2026-10-26T12:02:51.547610135Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"RHSA-2020:4272","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-09-13T22:43:13Z","modified":"2026-10-14T10:01:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:4903","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-09-13T22:43:09Z","modified":"2026-10-14T10:01:35Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5086","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T22:43:18Z","modified":"2026-10-14T10:01:38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4272","title":"Moderate: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.4).\n\nSecurity Fix(es):\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)\n\n* npm: Sensitive information exposure through logs (CVE-2020-15095)\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* The nodejs:12/development module is not installable (BZ#1883966)","status":"published","published":"2020-10-19T07:13:10Z","modified":"2026-02-04T20:45:08.733821Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-8201","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","status":"withdrawn","published":"2020-09-18T21:15:00Z","modified":"2025-07-16T07:41:54.08151Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2020:4272","title":"Moderate: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.4).\n\nSecurity Fix(es):\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)\n\n* npm: Sensitive information exposure through logs (CVE-2020-15095)\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* The nodejs:12/development module is not installable (BZ#1883966)","status":"published","published":"2020-10-19T07:13:10Z","modified":"2026-10-29T11:00:18.049115126Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-node-2020-8201","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","status":"published","published":"2024-03-06T11:08:09.371Z","modified":"2026-09-08T08:48:17.44918472Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2020-8201","description":"Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.","status":"published","published":"2024-12-16T14:07:02.33Z","modified":"2026-09-08T08:48:16.992014105Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"openSUSE-SU-2020:1616-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- nodejs12 was updated to 12.18.4 LTS:\n   - CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-10-05T04:22:45Z","modified":"2026-02-04T03:09:19.93763Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11096-1","title":"nodejs14-14.17.5-1.2 on GA media","description":"These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:56.833198Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:2812-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- nodejs12 was updated to 12.18.4 LTS:\n   - CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\n","status":"published","published":"2020-10-01T07:54:58Z","modified":"2026-02-04T04:13:15.246325Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2813-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- nodejs12 was updated to 12.18.4 LTS:\n   - CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\n","status":"published","published":"2020-10-01T07:55:11Z","modified":"2026-02-04T03:16:02.725898Z","updated_at":"2026-11-02T15:53:48.11786Z"}]}}