CVE-2024-27982

What it actually does

Malformed headers with a leading space before Content-Length are mishandled by the Node.js HTTP parser, allowing a second request to be embedded and processed as part of the first request body.

Why it matters to the business

Applications built on the affected Node.js stack may allow attackers to bypass access controls, poison caches, or reach internal endpoints, increasing risk of data exposure or unauthorized actions in production services.

How an attack unfolds

An attacker crafts an HTTP request containing a space-prefixed Content-Length header whose body includes a complete second HTTP request; the server mis-parses the headers and forwards the smuggled request to the application or backend, bypassing front-end security controls.

How to fix it

Upgrade mongoose (Bitnami) to version 6.4.6 or later; ensure the underlying Node.js runtime receives the latest security patches that correct header parsing behavior.

How to confirm the fix worked

Confirm the installed mongoose version is 6.4.6 or newer; replay test requests containing a leading space before Content-Length and verify the server no longer processes a smuggled second request.

Typical attack path

1. Scan for publicly reachable Node.js HTTP endpoints running vulnerable versions
2. Send a request with a space before the Content-Length header and a smuggled request in the body
3. Observe whether the backend processes the second request (e.g., via cache poisoning, internal API calls, or authentication bypass)
4. Chain the smuggling primitive with further attacks such as SSRF or privilege escalation

How to detect it

Inspect web server and application logs for requests that contain a space immediately before the Content-Length header name; correlate with downstream logs showing unexpected second requests or cache anomalies.

What your security team should do

• Immediately upgrade all instances of mongoose (Bitnami) to 6.4.6 or later
• Review and harden HTTP request parsing middleware and reverse-proxy configurations
• Monitor for unusual request patterns that could indicate smuggling attempts
• Apply Node.js runtime updates as soon as they become available