6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
0.003 Low
EPSS
Percentile
69.7%
Severity: Medium
Date : 2021-10-21
CVE-ID : CVE-2021-22959 CVE-2021-22960
Package : nodejs
Type : url request injection
Remote : Yes
Link : https://security.archlinux.org/AVG-2460
The package nodejs before version 16.11.1-1 is vulnerable to url
request injection.
Upgrade to 16.11.1-1.
The problems have been fixed upstream in version 16.11.1.
None.
A security issue has been found in Node.js before versions 16.11.1,
14.18.1 and 12.22.7. The http parser accepts requests with a space (SP)
right after the header name before the colon. This can lead to HTTP
Request Smuggling (HRS).
A security issue has been found in Node.js before versions 16.11.1,
14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing
the body of chunked requests. This leads to HTTP Request Smuggling
(HRS) under certain conditions.
A remote attacker could inject HTTP requests through crafted queries.
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959
https://hackerone.com/reports/1238099
https://hackerone.com/reports/1238709
https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91
https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4
https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960
https://security.archlinux.org/CVE-2021-22959
https://security.archlinux.org/CVE-2021-22960
github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0
github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4
github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91
hackerone.com/reports/1238099
hackerone.com/reports/1238709
nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959
nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960
security.archlinux.org/AVG-2460
security.archlinux.org/CVE-2021-22959
security.archlinux.org/CVE-2021-22960
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
0.003 Low
EPSS
Percentile
69.7%