The vulnerability of the Node.js software platform, related to deficiencies in HTTP request processing, allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).

🗓️ 22 Apr 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

The Node.js HTTP request processing flaw enables hidden HTTP requests via HTTP Request Smuggling.

Reporter	Title	Published	Views	Family All 252
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js vulnerabilities [ CVE-2024-27982, CVE-2024-27983]	4 Feb 202519:31	–	ibm
IBM Security Bulletins	Security Bulletin: Node.js vulnerabilities affect IBM Spectrum Control	8 Jul 202409:24	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js and packages affect IBM Voice Gateway	17 May 202413:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	5 Jun 202401:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.16 and earlier	29 May 202414:43	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	22 Jul 202414:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affects IBM Rational® Application Developer for WebSphere® Software (CVE-2024-27982, CVE-2024-27983)	14 Jun 202400:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Business Automation Workflow Configuration Editor	10 May 202408:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	26 Aug 202414:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities in multiple Open-Source Software (OSS) components	29 Jan 202519:19	–	ibm

Vulners

Node

novell suse_linux_enterprise_high_performance_computingMatch12

OR

novell suse_linux_enterprise_module_for_web_scriptingMatch12

OR

novell suse_manager_serverMatch4.3

OR

novell suse_enterprise_storageMatch7.1

OR

node.js node.jsRange<20.12.1

OR

node.js node.jsRange<18.20.1

OR

node.js undiciRange<5.28.4

OR

node.js undiciRange<6.11.1

OR

node.js node.jsRange18.0.0–21.7.1

OR

novell opensuse_leapMatch15.5

OR

novell suse_linux_enterprise_server_for_sap_applicationsMatch12

OR

novell suse_linux_enterprise_serverMatch12

Source	Link
nodejs	www.nodejs.org/en/blog/release/v20.12.1
suse	www.suse.com/security/cve/CVE-2024-27982.html
nodejs	www.nodejs.org/en/blog/vulnerability/april-2024-security-releases
github	www.github.com/nodejs/node/releases/tag/v21.7.2
github	www.github.com/nodejs/node/releases/tag/v20.12.1
github	www.github.com/nodejs/node/releases/tag/v18.20.1
github	www.github.com/nodejs/llhttp
security-tracker	www.security-tracker.debian.org/tracker/CVE-2024-27982
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
wiki	www.wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD

04 Mar 2026 00:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 36.1

CVSS 26.4

EPSS0.01155

node javascript hypertext transfer protocol request smuggling hidden requests