UpHeron
All vulnerabilities

Servers and applications

CVE-2018-7159

The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js…

Severity
Medium 5.3
Published
17 May 2018
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
4.9.0, 6.14.0, 8.11.0, 9.10.0
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 9.0.0 before 9.10.0
  • From 8.9.0 before 8.11.0
  • From 8.0.0 up to 8.8.1
  • From 6.9.0 before 6.14.0
All 7 release lines
  • From 4.0.0 up to 4.1.2
  • From 4.2.0 before 4.9.0
  • From 6.0.0 up to 6.8.1
  • From 6.9.0 before 6.14.0
  • From 8.0.0 up to 8.8.1
  • From 8.9.0 before 8.11.0
  • From 9.0.0 before 9.10.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-7159
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-7159