CVE-2018-7159

{"containers": {"cna": {"affected": [{"product": "Node.js", "vendor": "The Node.js Project", "versions": [{"status": "affected", "version": "4.x"}, {"status": "affected", "version": "6.x"}, {"status": "affected", "version": "8.x"}, {"status": "affected", "version": "9.x"}]}], "datePublic": "2018-03-21T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-115", "description": "CWE-115: Misinterpretation of Input", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-10-09T19:07:41.000Z", "orgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558", "shortName": "nodejs"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/"}, {"name": "RHSA-2019:2258", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:2258"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.f5.com/csp/article/K27228191?utm_source=f5support&amp%3Butm_medium=RSS"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-request@iojs.org", "DATE_PUBLIC": "2018-03-21T00:00:00", "ID": "CVE-2018-7159", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Node.js", "version": {"version_data": [{"version_value": "4.x"}, {"version_value": "6.x"}, {"version_value": "8.x"}, {"version_value": "9.x"}]}}]}, "vendor_name": "The Node.js Project"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-115: Misinterpretation of Input"}]}]}, "references": {"reference_data": [{"name": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/", "refsource": "CONFIRM", "url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/"}, {"name": "RHSA-2019:2258", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2258"}, {"name": "https://support.f5.com/csp/article/K27228191?utm_source=f5support&utm_medium=RSS", "refsource": "CONFIRM", "url": "https://support.f5.com/csp/article/K27228191?utm_source=f5support&utm_medium=RSS"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:24:10.511Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/"}, {"name": "RHSA-2019:2258", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:2258"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.f5.com/csp/article/K27228191?utm_source=f5support&amp%3Butm_medium=RSS"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2018-7159", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T21:07:47.854540Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T21:13:54.303Z"}}]}, "cveMetadata": {"assignerOrgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558", "assignerShortName": "nodejs", "cveId": "CVE-2018-7159", "datePublished": "2018-05-17T14:00:00.000Z", "dateReserved": "2018-02-15T00:00:00.000Z", "dateUpdated": "2026-10-08T21:13:54.303Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2019:2258", "name": "RHSA-2019:2258", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://support.f5.com/csp/article/K27228191?utm_source=f5support&amp%3Butm_medium=RSS", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:24:10.511Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2018-7159", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T21:07:47.854540Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T21:07:48.327Z"}}], "cna": {"affected": [{"vendor": "The Node.js Project", "product": "Node.js", "versions": [{"status": "affected", "version": "4.x"}, {"status": "affected", "version": "6.x"}, {"status": "affected", "version": "8.x"}, {"status": "affected", "version": "9.x"}]}], "datePublic": "2018-03-21T00:00:00.000Z", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://access.redhat.com/errata/RHSA-2019:2258", "name": "RHSA-2019:2258", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://support.f5.com/csp/article/K27228191?utm_source=f5support&amp%3Butm_medium=RSS", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-115", "description": "CWE-115: Misinterpretation of Input"}]}], "providerMetadata": {"orgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558", "shortName": "nodejs", "dateUpdated": "2019-10-09T19:07:41.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "4.x"}, {"version_value": "6.x"}, {"version_value": "8.x"}, {"version_value": "9.x"}]}, "product_name": "Node.js"}]}, "vendor_name": "The Node.js Project"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/", "name": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/", "refsource": "CONFIRM"}, {"url": "https://access.redhat.com/errata/RHSA-2019:2258", "name": "RHSA-2019:2258", "refsource": "REDHAT"}, {"url": "https://support.f5.com/csp/article/K27228191?utm_source=f5support&utm_medium=RSS", "name": "https://support.f5.com/csp/article/K27228191?utm_source=f5support&utm_medium=RSS", "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-115: Misinterpretation of Input"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2018-7159", "STATE": "PUBLIC", "ASSIGNER": "cve-request@iojs.org", "DATE_PUBLIC": "2018-03-21T00:00:00"}}}}, "cveMetadata": {"cveId": "CVE-2018-7159", "state": "PUBLISHED", "dateUpdated": "2026-10-08T21:13:54.303Z", "dateReserved": "2018-02-15T00:00:00.000Z", "assignerOrgId": "386269d4-a6c6-4eaa-bf8e-bc0b0d010558", "datePublished": "2018-05-17T14:00:00.000Z", "assignerShortName": "nodejs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Node.js", "vendor": "The Node.js Project", "versions": [{"status": "affected", "version": "4.x"}, {"status": "affected", "version": "6.x"}, {"status": "affected", "version": "8.x"}, {"status": "affected", "version": "9.x"}]}], "source": "cve-request@iojs.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "A47FC4F7-1F77-4314-B4B3-3C5D8E335379", "versionEndIncluding": "4.1.2", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "CC30BAD0-79DE-4FE9-982D-7252E668442F", "versionEndExcluding": "4.9.0", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "D107EC29-67E7-40C3-8E5A-324C9105C5E4", "versionEndIncluding": "6.8.1", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "B6855CC9-21A0-4C1B-8C27-A15FA0D7244F", "versionEndExcluding": "6.14.0", "versionStartIncluding": "6.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "74FB695D-2C76-47AB-988E-5629D2E695E5", "versionEndIncluding": "8.8.1", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "A6E7AD1F-26AA-4CBA-9162-7DFC0B09E620", "versionEndExcluding": "8.11.0", "versionStartIncluding": "8.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "8FC117F5-0B41-49F5-83DF-B830DEE95404", "versionEndExcluding": "9.10.0", "versionStartIncluding": "9.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete."}, {"lang": "es", "value": "El analizador HTTP en todas las versiones actuales de Node.js ignora los espacios en la cabecera \"Content-Length\", permitiendo que entradas como `Content-Length: 1 2\" se interpreten con un valor de \"12\". La especificaci\u00f3n HTTP no permite los espacios en el valor \"Content-Length\" y se ha destacado el analizador HTTP de Node.js con respecto a esta diferencia en concreto. El riesgo de seguridad de este error para los usuarios de Node.js se considera MUY BAJO, ya que es dif\u00edcil (y tal vez imposible) manipular un ataque que haga uso de este error de forma que no se pueda lograr ya proporcionando un valor incorrecto para \"Content-Length\". Podr\u00edan existir vulnerabilidades en el c\u00f3digo de usuario que realizan asunciones incorrectas sobre la precisi\u00f3n potencial de este valor comparado con la longitud total de los datos proporcionados. Se recomienda que los usuarios de Node.js que manipulan utilidades HTTP de bajo nivel vuelvan a comprobar la longitud de cualquier entrada proporcionada una vez se ha completado el an\u00e1lisis."}], "id": "CVE-2018-7159", "lastModified": "2026-10-08T22:16:47.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2018-7159", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T21:07:47.854540Z", "version": "2.0.3"}}]}, "published": "2018-05-17T14:29:00.653", "references": [{"source": "cve-request@iojs.org", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:2258"}, {"source": "cve-request@iojs.org", "tags": ["Vendor Advisory"], "url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/"}, {"source": "cve-request@iojs.org", "url": "https://support.f5.com/csp/article/K27228191?utm_source=f5support&amp%3Butm_medium=RSS"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:2258"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.f5.com/csp/article/K27228191?utm_source=f5support&amp%3Butm_medium=RSS"}], "sourceIdentifier": "cve-request@iojs.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-115"}], "source": "cve-request@iojs.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2019:2258", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "http-parser-0:2.7.1-8.el7", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2019-08-06T00:00:00Z"}, {"advisory": "RHSA-2018:2949", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs8-nodejs-0:8.11.4-1.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2018-10-18T00:00:00Z"}, {"advisory": "RHSA-2018:2949", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs8-nodejs-0:8.11.4-1.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS", "release_date": "2018-10-18T00:00:00Z"}, {"advisory": "RHSA-2018:2949", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-nodejs8-nodejs-0:8.11.4-1.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS", "release_date": "2018-10-18T00:00:00Z"}], "bugzilla": {"description": "nodejs: HTTP parser allowed for spaces inside Content-Length header values", "id": "1561981", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1561981"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "verified"}, "cwe": "CWE-20", "details": ["The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.", "It was found that the http module from Node.js could accept incorrect Content-Length values, containing spaces within the value, in HTTP headers. A specially crafted client could use this flaw to possibly confuse the script, causing unspecified behavior."], "name": "CVE-2018-7159", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "http-parser", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:openshift:3", "fix_state": "Not affected", "package_name": "nodejs", "product_name": "Red Hat OpenShift Enterprise 3"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Will not fix", "package_name": "rh-nodejs4-nodejs", "product_name": "Red Hat Software Collections"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Will not fix", "package_name": "rh-nodejs6-nodejs", "product_name": "Red Hat Software Collections"}], "public_date": "2018-03-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-7159\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-7159"], "threat_severity": "Low"}

{}