CVE-2018-7159
MediumCVSS 5.3Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
The HTTP parser in all current versions of Node.js ignores spaces in the Content-Length header, allowing input such as 'Content-Length: 1 2' to be interpreted as having a value of '12'. The HTTP specification does not allow for spaces in the Content-Length value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for Content-Length. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.
Risk Assessment
The vulnerability may lead to incorrect interpretations of content length, which combined with incorrect assumptions in user code could enable request smuggling or other HTTP request manipulations.
Recommendation
Update Node.js to the latest version that includes the fix, and review application code for assumptions about content length.
Other vulnerabilities in Node.js
See all- CVE-2026-21637High
A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths, leading to immediate process termination or silent file descriptor leaks that eventually cause denial of service.
- CVE-2025-59466High
A bug has been identified in Node.js error handling where 'Maximum call stack size exceeded' errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications relying on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
- CVE-2025-59464High
A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. Applications calling socket.getPeerCertificate(true) leak memory per certificate field, allowing remote clients to trigger steady memory growth through repeated TLS connections.
- CVE-2025-23166High
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs, potentially allowing an adversary to remotely crash a Node.js runtime.
- CVE-2025-23085Medium
A memory leak occurs in Node.js when a remote peer abruptly closes the socket without sending a GOAWAY notification, or when nghttp2 detects an invalid header and terminates the connection. This can lead to increased memory consumption and potential denial of service.
- CVE-2024-22018Low
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API, allowing malicious actors to retrieve stats from files they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
- CVE-2024-22020Medium
A flaw in Node.js allows bypassing network import restrictions by embedding non-network imports in data URLs. This enables an attacker to execute arbitrary code and compromise system security.
- CVE-2024-27982Medium
A critical vulnerability was identified in the HTTP server of the most recent Node version, where malformed headers can lead to HTTP request smuggling. Specifically, placing a space before a content-length header causes it to be misinterpreted, enabling attackers to smuggle a second request within the body of the first.
- CVE-2024-27983High
An attacker can make a Node.js HTTP/2 server completely unavailable by sending a small number of HTTP/2 frame packets. Data can remain in nghttp2 memory after a reset when headers with an HTTP/2 CONTINUATION frame are sent and the client abruptly closes the TCP connection, triggering a race condition.
- CVE-2015-7384High
Node.js versions 4.0.0, 4.1.0, and 4.1.1 allow remote attackers to cause a denial of service.
Original NVD description (English source)
The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS