CVE-2020-8287: Node.js HTTP Request Smuggling Vulnerability

CVE-2020-8287 Overview

CVE-2020-8287 is an HTTP Request Smuggling vulnerability affecting Node.js versions before 10.23.1, 12.20.1, 14.15.4, and 15.5.1. The vulnerability arises from improper handling of duplicate HTTP header fields, where Node.js processes only the first instance of a duplicated header (such as Transfer-Encoding) while ignoring subsequent occurrences. This inconsistent header parsing behavior can be exploited by attackers to perform HTTP Request Smuggling attacks against applications built on vulnerable Node.js versions.

Critical Impact

Attackers can exploit this vulnerability to bypass security controls, poison web caches, hijack user sessions, or gain unauthorized access to backend systems by manipulating how HTTP requests are interpreted between front-end proxies and back-end Node.js servers.

Affected Products

• Node.js versions before 10.23.1 (LTS)
• Node.js versions before 12.20.1 (LTS)
• Node.js versions before 14.15.4 (LTS)
• Node.js versions before 15.5.1
• Debian Linux 10.0
• Fedora 32 and 33
• Oracle GraalVM Enterprise 19.3.4 and 20.3.0
• Siemens SINEC Infrastructure Network Services

Discovery Timeline

• January 6, 2021 - CVE-2020-8287 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-8287

Vulnerability Analysis

This HTTP Request Smuggling vulnerability (CWE-444) stems from Node.js's HTTP parser behavior when processing duplicate header fields in incoming requests. When an HTTP request contains multiple instances of the same header field—specifically critical headers like Transfer-Encoding—Node.js only processes the first occurrence and silently discards subsequent ones.

This parsing discrepancy becomes exploitable in environments where Node.js applications sit behind reverse proxies, load balancers, or CDNs that may interpret the same request differently. Since different HTTP implementations may prioritize different instances of duplicate headers, an attacker can craft requests that are interpreted one way by a front-end proxy and differently by the back-end Node.js server.

The attack surface extends to any Node.js application accepting HTTP traffic through intermediate proxies, making this vulnerability particularly impactful for web services, APIs, and microservices architectures.

Root Cause

The root cause lies in the HTTP request parsing logic within Node.js's HTTP module. When the parser encounters duplicate header fields, it implements a "first wins" strategy, accepting only the initial header value. This behavior violates RFC 7230 specifications for handling duplicate headers and creates parsing inconsistencies when front-end systems implement different strategies (such as "last wins" or concatenation).

The inconsistent interpretation of requests between proxy layers and Node.js enables HTTP desynchronization attacks where the boundaries between HTTP requests become ambiguous.

Attack Vector

HTTP Request Smuggling via duplicate header manipulation represents a network-based attack vector requiring no authentication or user interaction. An attacker sends a specially crafted HTTP request containing duplicate Transfer-Encoding or similar headers to a vulnerable Node.js application behind a reverse proxy.

The front-end proxy interprets the request boundary using one header value, while Node.js uses a different interpretation based on its first-header-wins logic. This desynchronization allows attackers to "smuggle" malicious requests that bypass front-end security controls, or to poison the request queue affecting other users' sessions.

For example, if a proxy honors the second Transfer-Encoding header while Node.js honors the first, an attacker can embed a hidden request within what appears to be a single legitimate request. Technical details of this attack are documented in the HackerOne Report #1002188.

Detection Methods for CVE-2020-8287

Indicators of Compromise

• HTTP requests containing multiple instances of Transfer-Encoding or Content-Length headers in server logs
• Unexpected request parsing errors or malformed request warnings in Node.js application logs
• Anomalous HTTP traffic patterns showing requests with conflicting body length indicators
• Cache poisoning symptoms where incorrect content is served to legitimate users

Detection Strategies

• Implement HTTP request validation at the proxy layer to reject requests with duplicate critical headers before reaching Node.js
• Deploy web application firewalls (WAF) configured to detect and block HTTP Request Smuggling patterns
• Monitor Node.js application logs for unusual parsing behavior or header-related warnings
• Use intrusion detection systems with signatures for known HTTP desynchronization attack patterns

Monitoring Recommendations

• Enable detailed HTTP access logging at both proxy and application tiers to correlate request interpretation differences
• Configure alerting for requests containing duplicate Transfer-Encoding, Content-Length, or other hop-by-hop headers
• Implement request timing analysis to detect desynchronization anomalies in multi-tier architectures
• Regularly audit proxy and Node.js configurations for consistent header handling policies

How to Mitigate CVE-2020-8287

Immediate Actions Required

• Upgrade Node.js to patched versions: 10.23.1, 12.20.1, 14.15.4, or 15.5.1 or later immediately
• Review and update dependent products including Oracle GraalVM and Siemens SINEC Infrastructure Network Services
• Configure front-end proxies to normalize or reject requests with duplicate headers before forwarding to Node.js
• Audit all Node.js deployments across development, staging, and production environments

Patch Information

Security patches are available from the Node.js project addressing this vulnerability. Refer to the Node.js January 2021 Security Releases for official patch information and upgrade guidance. Additional vendor-specific patches are documented in:

• Debian Security Advisory DSA-4826
• Gentoo GLSA 202101-07
• Oracle Security Alert January 2021
• Siemens Security Advisory SSA-389290

Workarounds

• Configure reverse proxies (nginx, HAProxy, Apache) to reject or sanitize requests containing duplicate Transfer-Encoding or Content-Length headers
• Implement strict HTTP parsing modes in front-end proxies where available
• Deploy WAF rules specifically targeting HTTP Request Smuggling attack patterns
• Consider network segmentation to limit exposure of vulnerable Node.js instances while patches are applied

# nginx configuration to reject requests with duplicate Transfer-Encoding headers
# Add to server or location block
if ($http_transfer_encoding ~* ".*,.*") {
    return 400;
}