What is CVE-2020-8201?

CVE-2020-8201 is a high-severity vulnerability in Node.js Node, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 7.4/10. Published 2020-09-18.

How severe is CVE-2020-8201?

High severity. CVSS v3 base score is 7.4 out of 10.

Is CVE-2020-8201 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Node.js Node

CVE-2020-8201

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Vulnerability class: HTTP Request Smuggling

Published 2020-09-18 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.053 (92.3th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 92.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.051 · newest: 0.053 · change: +0.002

Affected products

Node.js Node — versions 4.0, 5.0, 6.0
Node.js
Fedoraproject Fedora — versions 33
openSUSE Leap — versions 15.2

Weakness classification (CWE)

CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling)

Public proof-of-concept exploits

dnorio/oracle-node-alpine

References

nodejs.org/en/blog/vulnerability/september-2020-security-releases/ (Vendor Advisory)
hackerone.com/reports/922597 (Permissions Required)
lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html (vendor-advisory, Third Party Advisory)
security.netapp.com/advisory/ntap-20201009-0004/ (Third Party Advisory)
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
security.gentoo.org/glsa/202101-07 (vendor-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2020-8201?: CVE-2020-8201 is a high-severity vulnerability in Node.js Node, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 7.4/10. Published 2020-09-18.
How severe is CVE-2020-8201?: High severity. CVSS v3 base score is 7.4 out of 10.
Is CVE-2020-8201 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.