Not rated
CVE-2020-8201 Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to…
Description
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 14.0 | 14.0 → < 14.11.0 | 14.11.0 |
| Node 13.0 | 13.0 → latest | No fix stated |
| Node 12.0 | 12.0 → < 12.18.4 | 12.18.4 |
| Node 11.0 | 11.0 → latest | No fix stated |
| Node 9.0 | 9.0 → latest | No fix stated |
| Node 8.0 | 8.0 → latest | No fix stated |
| Node 7.0 | 7.0 → latest | No fix stated |
| Node 6.0 | 6.0 → latest | No fix stated |
| Node 5.0 | 5.0 → latest | No fix stated |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 4.0 | 4.0 → latest | No fix stated |
Other CVEs of Node
The 129 CVEs of Node →
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Medium
CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read…
3.3
Low
CVE-2026-105481
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before…
6.5
Medium
CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*()…
7.4
High