high 7.4

CVE-2020-8201 json

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users.

published 2020-09-18 6 y ago modified 2026-09-08 2 mo ago also BIT-node-2020-8201 , BIT-node-min-2020-8201 , EUVD-2020-29078

cvss: 7.4; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 5.3%; EPSS 5.3% chance of exploitation in 30 days, percentile 92%
public exploits: 0; none known

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Patch / fix

fixed in 3 distros 7

bitnami node 12.18.4, 14.11.0
bitnami node-min 12.18.4, 14.11.0
NodeJS Node 12.18.4, 14.11.0

debian red hat suse opensuse almalinux rocky linux alpine

nodejs Debian 14, Debian 13, Debian 12 12.18.4~dfsg-1

debian advisories DEBIAN-CVE-2020-8201

rh-nodejs12-nodejs RHEL 3 SOFTWARE_COLLECTIONS 12.18.4-3.el7
rh-nodejs12-npm RHEL 3 SOFTWARE_COLLECTIONS 6.14.6-12.18.4.3.el7
npm RHEL 8 1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e
nodejs RHEL 8 1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-nodemon RHEL 8, RHEL 8.1 EUS 1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-full-i18n RHEL 8 1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-packaging RHEL 8, RHEL 8.1 EUS 17-3.module+el8.1.0+3369+37ae6a45
npm RHEL 8.1 EUS 1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500

red hat advisories RHSA-2020:5086 RHSA-2020:4272 RHSA-2020:4903

nodejs12 SLE Module for Web and Scripting 15 SP2 12.18.4-4.6.1
nodejs12 SLE Module for Web and Scripting 12 12.18.4-1.20.1

suse advisories SUSE-SU-2020:2813-1 SUSE-SU-2020:2812-1

nodejs14 openSUSE Tumbleweed 14.17.5-1.2
nodejs12 openSUSE Leap 15.2 12.18.4-lp152.3.6.1

opensuse advisories openSUSE-SU-2024:11096-1 openSUSE-SU-2020:1616-1

nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2023+d2377ea3
nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging AlmaLinux 8 17-3.module_el8.3.0+2023+d2377ea3

almalinux advisories ALSA-2020:4272

nodejs-nodemon Rocky Linux 8 1.18.3-1.module+el8.3.0+101+f84c7154
nodejs-packaging Rocky Linux 8 17-3.module+el8.3.0+101+f84c7154

rocky linux advisories RLSA-2020:4272

nodejs Alpine 3.11 12.20.1-r0
nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 12.18.4-r0
nodejs-current Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 14.11.0-r0

alpine advisories ALPINE-CVE-2020-8201

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8201 updated 2026-11-07 cvss 7.4

nodejs: HTTP request smuggling due to CR-to-Hyphen conversion

Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more
affected: no fix available
Red Hat Quay 3 quay
affected: no fix available “Fix deferred”
Red Hat Enterprise Linux AppStream (v. 8) nodejs 12.18.4-2.module+el8.2.0+8361+192e434e, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, npm 6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, nodejs-full-i18n 12.18.4-2.module+el8.2.0+8361+192e434e
fixed: vendor fix RHSA-2020:4272
Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs 12.18.4-2.module+el8.1.0+8360+14141500, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, npm 6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, nodejs-full-i18n 12.18.4-2.module+el8.1.0+8360+14141500
fixed: vendor fix RHSA-2020:4903
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs 12.18.4-3.el7, rh-nodejs12-npm 6.14.6-12.18.4.3.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs12-nodejs 12.18.4-3.el7, rh-nodejs12-npm 6.14.6-12.18.4.3.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs 12.18.4-3.el7, rh-nodejs12-npm 6.14.6-12.18.4.3.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs 12.18.4-3.el7, rh-nodejs12-npm 6.14.6-12.18.4.3.el7
fixed: vendor fix RHSA-2020:5086
Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Software Collections rh-nodejs10-npm, rh-nodejs10-nodejs
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-22-111-03 updated 2022-04-21 cvss 7.4

Hitachi Energy MicroSCADA Pro/X SYS600

Hitachi Energy SYS600 <= 10.1.1, <=9.4 FP1, >= 10.2.1, >= 10.0.0, <= 10.2.1
affected: mitigation “For more information see Hitachi Energy advisory 8DBD000075” search.abb.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

5.30% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N
OSV	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	node	>=12.0.0, <12.18.4 >=14.0.0, <14.11.0	12.18.4 14.11.0
bitnami	node-min	>=12.0.0, <12.18.4 >=14.0.0, <14.11.0	12.18.4 14.11.0

Affected products

NodeJS Node

Classification

Weakness

CWE-444 Inconsistent Interpretation of HTTP Requests

Technology feeds

Node.js rss critical rss

References

lists.opensuse.org /opensuse-security-announce/2020-10/msg00011.html
vendor-advisory, third-party-advisory, advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/
vendor-advisory, web
security.gentoo.org /glsa/202101-07
vendor-advisory, third-party-advisory, advisory
nodejs.org /en/blog/vulnerability/september-2020-security-releases/
vendor-advisory, advisory
hackerone.com /reports/922597
permissions-required, web
security.netapp.com /advisory/ntap-20201009-0004/
third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2020-8201
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary