Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2020-8201

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The…

High7.4EPSS 5.3%
Published
Updated
Reserved
Assigned by
hackerone

Description

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

Scores

CVSS scores of CVE-2020-8201, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.1High7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS (exploitation in 30 days)
5.3% · top 7.4% of all CVEs (5 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.

Weakness

Affected products

  • NodeJS · Node

    • affected 4.0 – < 4.*
    • affected 5.0 – < 5.*
    • affected 6.0 – < 6.*
    • affected 7.0 – < 7.*
    • affected 8.0 – < 8.*
    • affected 9.0 – < 9.*
    • affected 11.0 – < 11.*
    • affected 12.0 – < 12.18.4
    • affected 13.0 – < 13.*
    • affected 14.0 – < 14.11.0

References (6)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2020-8201 badge
[![CVE-2020-8201](https://trackcve.app/badge/CVE-2020-8201.svg)](https://trackcve.app/cve/CVE-2020-8201)

Record last updated .