CVE-2018-7159: node.js from 4.0.0 (inclusive), through 4.1.2 (inclusive), from 4.2.0 (inclusive), before 4.9.0 (exclusive), from…

Affected technology

node.js · from 4.0.0 (inclusive), through 4.1.2 (inclusive)
nodejs

node.js · from 4.2.0 (inclusive), before 4.9.0 (exclusive)
nodejs

node.js · from 6.0.0 (inclusive), through 6.8.1 (inclusive)
nodejs

node.js · from 6.9.0 (inclusive), before 6.14.0 (exclusive)
nodejs

node.js · from 8.0.0 (inclusive), through 8.8.1 (inclusive)
nodejs

node.js · from 8.9.0 (inclusive), before 8.11.0 (exclusive)
nodejs

node.js · from 9.0.0 (inclusive), before 9.10.0 (exclusive)
nodejs

Node.js · 4.x, 6.x, 8.x, 9.x
The Node.js Project

Description’s affected range: versions of Node.js ignores spaces in the `Content-Length` header

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and availability impact as none; integrity impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.