| Package | Affected versions | Patched versions |
|---|---|---|
| node.js | ≥ 10.0.0, < 10.23.1≥ 12.0.0, < 12.20.1≥ 14.0.0, < 14.15.4≥ 15.0.0, < 15.5.1 | 10.23.112.20.114.15.415.5.1 |
| graalvm | = 19.3.4= 20.3.0 | |
| sinec infrastructure network services | < 1.0.1.1 | 1.0.1.1 |
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free