CVE-2016-2216 The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-...
HighCVSS 7.5
EPSS 7.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nodejs(Debian:12) | < 4.3.0~dfsg-1 | 4.3.0~dfsg-1 |
| debian/nodejs(Debian:13) | < 4.3.0~dfsg-1 | 4.3.0~dfsg-1 |
| debian/nodejs(Debian:14) | < 4.3.0~dfsg-1 | 4.3.0~dfsg-1 |
| nodejs node.js | = 0.10.0 | No fix listed |
| nodejs node.js | = 0.10.1 | No fix listed |
| nodejs node.js | = 0.10.2 | No fix listed |
| nodejs node.js | = 0.10.3 | No fix listed |
| nodejs node.js | = 0.10.4 | No fix listed |
| nodejs node.js | = 0.10.5 | No fix listed |
| nodejs node.js | = 0.10.6 | No fix listed |
| nodejs node.js | = 0.10.7 | No fix listed |
| nodejs node.js | = 0.10.8 | No fix listed |
| nodejs node.js | = 0.10.9 | No fix listed |
| nodejs node.js | = 0.10.10 | No fix listed |
| nodejs node.js | = 0.10.11 | No fix listed |
| nodejs node.js | = 0.10.12 | No fix listed |
| nodejs node.js | = 0.10.13 | No fix listed |
| nodejs node.js | = 0.10.14 | No fix listed |
| nodejs node.js | = 0.10.15 | No fix listed |
| nodejs node.js | = 0.10.16 | No fix listed |
| nodejs node.js | = 0.10.16-isaacs-manual | No fix listed |
| nodejs node.js | = 0.10.17 | No fix listed |
| nodejs node.js | = 0.10.18 | No fix listed |
| nodejs node.js | = 0.10.19 | No fix listed |
| nodejs node.js | = 0.10.20 | No fix listed |
Show 63 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs node.js | = 0.10.21 | No fix listed |
| nodejs node.js | = 0.10.22 | No fix listed |
| nodejs node.js | = 0.10.23 | No fix listed |
| nodejs node.js | = 0.10.24 | No fix listed |
| nodejs node.js | = 0.10.25 | No fix listed |
| nodejs node.js | = 0.10.26 | No fix listed |
| nodejs node.js | = 0.10.27 | No fix listed |
| nodejs node.js | = 0.10.28 | No fix listed |
| nodejs node.js | = 0.10.29 | No fix listed |
| nodejs node.js | = 0.10.30 | No fix listed |
| nodejs node.js | = 0.10.31 | No fix listed |
| nodejs node.js | = 0.10.32 | No fix listed |
| nodejs node.js | = 0.10.33 | No fix listed |
| nodejs node.js | = 0.10.34 | No fix listed |
| nodejs node.js | = 0.10.35 | No fix listed |
| nodejs node.js | = 0.10.36 | No fix listed |
| nodejs node.js | = 0.10.37 | No fix listed |
| nodejs node.js | = 0.10.38 | No fix listed |
| nodejs node.js | = 0.10.39 | No fix listed |
| nodejs node.js | = 0.10.40 | No fix listed |
| nodejs node.js | = 0.10.41 | No fix listed |
| nodejs node.js | = 0.11.6 | No fix listed |
| nodejs node.js | = 0.11.7 | No fix listed |
| nodejs node.js | = 0.11.8 | No fix listed |
| nodejs node.js | = 0.11.9 | No fix listed |
| nodejs node.js | = 0.11.10 | No fix listed |
| nodejs node.js | = 0.11.11 | No fix listed |
| nodejs node.js | = 0.11.12 | No fix listed |
| nodejs node.js | = 0.11.13 | No fix listed |
| nodejs node.js | = 0.11.14 | No fix listed |
| nodejs node.js | = 0.11.15 | No fix listed |
| nodejs node.js | = 0.11.16 | No fix listed |
| nodejs node.js | = 0.12.0 | No fix listed |
| nodejs node.js | = 0.12.1 | No fix listed |
| nodejs node.js | = 0.12.2 | No fix listed |
| nodejs node.js | = 0.12.3 | No fix listed |
| nodejs node.js | = 0.12.4 | No fix listed |
| nodejs node.js | = 0.12.5 | No fix listed |
| nodejs node.js | = 0.12.6 | No fix listed |
| nodejs node.js | = 0.12.7 | No fix listed |
| nodejs node.js | = 0.12.8 | No fix listed |
| nodejs node.js | = 0.12.9 | No fix listed |
| nodejs node.js | = 4.0.0 | No fix listed |
| nodejs node.js | = 4.1.0 | No fix listed |
| nodejs node.js | = 4.1.1 | No fix listed |
| nodejs node.js | = 4.1.2 | No fix listed |
| nodejs node.js | = 4.2.0 | No fix listed |
| nodejs node.js | = 4.2.1 | No fix listed |
| nodejs node.js | = 4.2.2 | No fix listed |
| nodejs node.js | = 4.2.3 | No fix listed |
| nodejs node.js | = 4.2.4 | No fix listed |
| nodejs node.js | = 4.2.5 | No fix listed |
| nodejs node.js | = 4.2.6 | No fix listed |
| nodejs node.js | = 5.0.0 | No fix listed |
| nodejs node.js | = 5.1.0 | No fix listed |
| nodejs node.js | = 5.1.1 | No fix listed |
| nodejs node.js | = 5.2.0 | No fix listed |
| nodejs node.js | = 5.3.0 | No fix listed |
| nodejs node.js | = 5.4.0 | No fix listed |
| nodejs node.js | = 5.4.1 | No fix listed |
| nodejs node.js | = 5.5.0 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
References
- Debian Security Tracker CVE-2016-2216 vendor-advisory
- blog.safebreach.com
- info.safebreach.com
- FEDORA-2016-3102c11757 vendor-advisory
- FEDORA-2016-8925b6119f vendor-advisory
- packetstormsecurity.com
- 83141 vdb-entry
- nodejs.org patch vendor-advisory
- GLSA-201612-43 vendor-advisory