Skip to content
Fencer Vulns
medium 5.3

CVE-2018-7159 json

The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1…

published 2018-05-17 8 y ago modified 2026-10-08 31 d ago also EUVD-2018-18902

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.5%
EPSS 3.5% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.

Patch / fix

  • nodejs node.js 4.9.0, 6.14.0, 8.11.0, 9.10.0
  • nodejs Debian 14, Debian 13, Debian 12 8.11.1~dfsg-2

debian advisories DEBIAN-CVE-2018-7159

  • http-parser RHEL 7 2.7.1-8.el7
  • rh-nodejs8-nodejs RHEL 3 SOFTWARE_COLLECTIONS 8.11.4-1.el7
  • rh-nodejs8-npm RHEL 3 SOFTWARE_COLLECTIONS 5.6.0-8.11.4.1.el7

red hat advisories RHSA-2019:2258RHSA-2018:2949

  • nodejs6 SLE Module for Web and Scripting 12, OpenStack Cloud 7, Enterprise Storage 4 6.14.1-11.12.1
  • nodejs4 SLE Module for Web and Scripting 12, Enterprise Storage 4 4.9.1-15.11.1
  • firefox-atk SLES 11 SP4-LTSS 2.26.1-2.8.4
  • mozilla-nss SLES 11 SP4-LTSS 3.45-38.9.3
  • firefox-gtk3 SLES 11 SP4-LTSS 3.10.9-2.15.3
  • mozilla-nspr SLES 11 SP4-LTSS 4.21-29.6.1
  • firefox-cairo SLES 11 SP4-LTSS 1.15.10-2.13.4
  • firefox-glib2 SLES 11 SP4-LTSS 2.54.3-2.14.7

suse advisories SUSE-SU-2019:14246-1SUSE-SU-2018:1183-1SUSE-SU-2018:0952-1

  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 8.11.0-r0
  • nodejs-current Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 9.10.0-r0

alpine advisories ALPINE-CVE-2018-7159

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rubygem-http_parser Azure Linux 3.0 0.8.0-1

azure linux advisories AZL-40842

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-7159 updated cvss 5.3

nodejs: HTTP parser allowed for spaces inside Content-Length header values

  • Red Hat Software Collections rh-nodejs4-nodejs, rh-nodejs6-nodejs
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) http-parser 2.7.1-8.el7 Red Hat Enterprise Linux Client Optional (v. 7) http-parser-devel 2.7.1-8.el7, http-parser-debuginfo 2.7.1-8.el7 Red Hat Enterprise Linux ComputeNode (v. 7) http-parser 2.7.1-8.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) http-parser-devel 2.7.1-8.el7, http-parser-debuginfo 2.7.1-8.el7 Red Hat Enterprise Linux Server (v. 7) http-parser 2.7.1-8.el7 Red Hat Enterprise Linux Server Optional (v. 7) http-parser-devel 2.7.1-8.el7, http-parser-debuginfo 2.7.1-8.el7
    +2 more products
    Red Hat Enterprise Linux Workstation (v. 7) http-parser 2.7.1-8.el7 Red Hat Enterprise Linux Workstation Optional (v. 7) http-parser-devel 2.7.1-8.el7, http-parser-debuginfo 2.7.1-8.el7
    fixed: vendor fix RHSA-2019:2258
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs8-nodejs 8.11.4-1.el7, rh-nodejs8-npm 5.6.0-8.11.4.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-nodejs8-nodejs 8.11.4-1.el7, rh-nodejs8-npm 5.6.0-8.11.4.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs8-nodejs 8.11.4-1.el7, rh-nodejs8-npm 5.6.0-8.11.4.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs8-nodejs 8.11.4-1.el7, rh-nodejs8-npm 5.6.0-8.11.4.1.el7
    fixed: vendor fix RHSA-2018:2949
  • Red Hat Enterprise Linux 8 npm, nodejs, http-parser, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, +2 more Red Hat OpenShift Enterprise 3 nodejs
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

3.54% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • The Node.js Project Node.js

Classification

Weakness
  • CWE-115 Misinterpretation of Input
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.