CVE catalog
CVE-2018-7159
nodejs: CVE-2018-7159
- Severity
- Medium · CVSS 5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 3.56% · Oct 25, 2026
The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | nodejs | sid | 24.22.1+dfsg+~cs24.19.2-1 | fixed |
| Debian | nodejs | forky | 24.21.0+dfsg+~cs24.13.4-1 | fixed |
| Debian | nodejs | trixie | 20.19.2+dfsg-1+deb13u2 | fixed |
| Debian | nodejs | trixie-security | 20.19.2+dfsg-1+deb13u3 | fixed |
| Debian | nodejs | bookworm | 18.20.4+dfsg-1~deb12u2 | fixed |
| Debian | nodejs | bookworm-security | 18.20.4+dfsg-1~deb12u3 | fixed |
| Cpe | node.js | Not reported | 9.10.0 | fixed |
| Alpine | nodejs | 3.10 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.11 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.12 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.13 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.14 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.15 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.16 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.17 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.18 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.19 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.20 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.21 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.22 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.23 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.24 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.8 | 8.11.0-r0 | fixed |
| Alpine | nodejs | 3.9 | 8.11.0-r0 | fixed |
| Ubuntu | nodejs | pro | 6.11.4~dfsg-1ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 6.11.4~dfsg-1ubuntu2 | vulnerable |
| Ubuntu | nodejs | pro | 6.12.0~dfsg-1ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 6.12.0~dfsg-2ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 6.12.0~dfsg-2ubuntu2 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.2 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.3 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm1 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm2 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm3 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm4 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm5 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm6 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | nodejs | source | sid | 8.11.1~dfsg-2 | unimportant | Not reported | Not reported |
| Debian | nodejs | source | forky | 8.11.1~dfsg-2 | unimportant | Not reported | Not reported |
| Debian | nodejs | source | trixie | 8.11.1~dfsg-2 | unimportant | Not reported | Not reported |
| Debian | nodejs | source | bookworm | 8.11.1~dfsg-2 | unimportant | Not reported | Not reported |
| Cpe | node.js | cpe | Not reported | 9.10.0 | Not reported | NVD-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.10 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.11 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.12 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.13 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.14 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.15 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.16 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.17 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.18 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.19 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.20 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.21 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.22 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.23 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.24 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.8 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
| Alpine | nodejs | apk | 3.9 | 8.11.0-r0 | Not reported | ALPINE-CVE-2018-7159 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [libnode108]Unknown
Source package: [nodejs]
Details (4)
18.20.4+dfsg-1~deb12u2· amd64 · bookwormFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookwormFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· amd64 · bookworm-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookworm-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- [libnode-dev]Unknown
Source package: [nodejs]
Details (4)
18.20.4+dfsg-1~deb12u2· amd64 · bookwormFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookwormFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· amd64 · bookworm-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookworm-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- [nodejs]Unknown
Details (4)
18.20.4+dfsg-1~deb12u2· amd64 · bookwormFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookwormFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· amd64 · bookworm-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookworm-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- [nodejs-doc]Unknown
Source package: [nodejs]
Details (4)
18.20.4+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
[Debian 13 (Trixie)]
- [libnode115]Unknown
Source package: [nodejs]
Details (5)
20.19.2+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixie-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· amd64 · trixie-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
- [libnode-dev]Unknown
Source package: [nodejs]
Details (5)
20.19.2+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixie-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· amd64 · trixie-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
- [nodejs]Unknown
Details (5)
20.19.2+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixie-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· amd64 · trixie-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
- [nodejs-doc]Unknown
Source package: [nodejs]
Details (5)
20.19.2+dfsg-1+deb13u2· all · trixieFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· all · trixieFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· all · trixie-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· all · trixie-security · Historical versionFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· all · trixie-securityFixed · Fixed:
8.11.1~dfsg-2dsa · nodejs · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2019_2258.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2018-7159]
- [https://osv.dev/vulnerability/ALPINE-CVE-2018-7159]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2018-7159]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2018-7159]
- [https://security-tracker.debian.org/tracker/CVE-2018-7159]
- [https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-7159.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2019/wid-sec-w-2022-0517.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]