Arch Linux Security Advisory ASA-202110-4 ========================================= Severity: Medium Date : 2021-10-21 CVE-ID : CVE-2021-22959 CVE-2021-22960 Package : nodejs Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-2460 Summary ======= The package nodejs before version 16.11.1-1 is vulnerable to url request injection. Resolution ========== Upgrade to 16.11.1-1. # pacman -Syu "nodejs>=16.11.1-1" The problems have been fixed upstream in version 16.11.1. Workaround ========== None. Description =========== - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Impact ====== A remote attacker could inject HTTP requests through crafted queries. References ========== https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-re... https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b... https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fd... https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0... https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-re... https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960