CVE-2020-8287

CVE-2020-8287

Vendor Nodejs
Product Node
Weakness CWE-444
Published January 6, 2021
Last update April 30, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

Key dates

02Disclosure timeline

January 6, 2021 CVE published
April 30, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-21295 Possible request smuggling in HTTP/2 due missing validation CVE-2026-47676 Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths CVE-2026-23941 Request smuggling via first-wins Content-Length parsing in inets httpd CVE-2023-46589 Apache Tomcat: HTTP request smuggling via malformed trailer headers CVE-2026-11806 IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability