Not rated
CVE-2020-8201 Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to…
Description
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 14.0 | 14.0 → < 14.11.0 | 14.11.0 |
| Node 13.0 | 13.0 → latest | No fix stated |
| Node 12.0 | 12.0 → < 12.18.4 | 12.18.4 |
| Node 11.0 | 11.0 → latest | No fix stated |
| Node 9.0 | 9.0 → latest | No fix stated |
| Node 8.0 | 8.0 → latest | No fix stated |
| Node 7.0 | 7.0 → latest | No fix stated |
| Node 6.0 | 6.0 → latest | No fix stated |
| Node 5.0 | 5.0 → latest | No fix stated |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 4.0 | 4.0 → latest | No fix stated |
Other CVEs of Node
The 129 CVEs of Node →
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Medium
CVE-2026-106070
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after…
3.7
Low
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…
3.6
Low
CVE-2026-106069
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…
7.4
High