Back to search
CVE-2020-8201
Published: Sep 18, 2020
Modified: Apr 30, 2025
PUBLISHED
Description
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
| Vendor | Product | Versions |
|---|---|---|
NodeJS | Node | affected 4.0 - < 4.*affected 5.0 - < 5.*affected 6.0 - < 6.*affected 7.0 - < 7.*affected 8.0 - < 8.*+5 more versions |
Weaknesses (CWE)
References
https://hackerone.com/reports/922597
x_refsource_MISC
openSUSE-SU-2020:1616
vendor-advisory
x_refsource_SUSE
https://security.netapp.com/advisory/ntap-20201009-0004/
x_refsource_CONFIRM
FEDORA-2020-43d5a372fc
vendor-advisory
x_refsource_FEDORA
GLSA-202101-07
vendor-advisory
x_refsource_GENTOO
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now