CVE-2016-5325 CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject....
MediumCVSS 6.1
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nodejs(Debian:12) | < 4.6.0~dfsg-1 | 4.6.0~dfsg-1 |
| debian/nodejs(Debian:13) | < 4.6.0~dfsg-1 | 4.6.0~dfsg-1 |
| debian/nodejs(Debian:14) | < 4.6.0~dfsg-1 | 4.6.0~dfsg-1 |
| nodejs node.js | = 4.0.0 | No fix listed |
| nodejs node.js | = 4.1.0 | No fix listed |
| nodejs node.js | = 4.1.1 | No fix listed |
| nodejs node.js | = 4.1.2 | No fix listed |
| nodejs node.js | = 4.2.0 | No fix listed |
| nodejs node.js | = 4.2.1 | No fix listed |
| nodejs node.js | = 4.2.2 | No fix listed |
| nodejs node.js | = 4.2.3 | No fix listed |
| nodejs node.js | = 4.2.4 | No fix listed |
| nodejs node.js | = 4.2.5 | No fix listed |
| nodejs node.js | = 4.2.6 | No fix listed |
| nodejs node.js | = 4.3.0 | No fix listed |
| nodejs node.js | = 4.3.1 | No fix listed |
| nodejs node.js | = 4.3.2 | No fix listed |
| nodejs node.js | = 4.4.0 | No fix listed |
| nodejs node.js | = 4.4.1 | No fix listed |
| nodejs node.js | = 4.4.2 | No fix listed |
| nodejs node.js | = 4.4.3 | No fix listed |
| nodejs node.js | = 4.4.4 | No fix listed |
| nodejs node.js | = 4.4.5 | No fix listed |
| nodejs node.js | = 4.4.6 | No fix listed |
| nodejs node.js | = 4.4.7 | No fix listed |
Show 76 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs node.js | = 4.5.0 | No fix listed |
| nodejs node.js | = 0.10.0 | No fix listed |
| nodejs node.js | = 0.10.1 | No fix listed |
| nodejs node.js | = 0.10.2 | No fix listed |
| nodejs node.js | = 0.10.3 | No fix listed |
| nodejs node.js | = 0.10.4 | No fix listed |
| nodejs node.js | = 0.10.5 | No fix listed |
| nodejs node.js | = 0.10.6 | No fix listed |
| nodejs node.js | = 0.10.7 | No fix listed |
| nodejs node.js | = 0.10.8 | No fix listed |
| nodejs node.js | = 0.10.9 | No fix listed |
| nodejs node.js | = 0.10.10 | No fix listed |
| nodejs node.js | = 0.10.11 | No fix listed |
| nodejs node.js | = 0.10.12 | No fix listed |
| nodejs node.js | = 0.10.13 | No fix listed |
| nodejs node.js | = 0.10.14 | No fix listed |
| nodejs node.js | = 0.10.15 | No fix listed |
| nodejs node.js | = 0.10.16 | No fix listed |
| nodejs node.js | = 0.10.16-isaacs-manual | No fix listed |
| nodejs node.js | = 0.10.17 | No fix listed |
| nodejs node.js | = 0.10.18 | No fix listed |
| nodejs node.js | = 0.10.19 | No fix listed |
| nodejs node.js | = 0.10.20 | No fix listed |
| nodejs node.js | = 0.10.21 | No fix listed |
| nodejs node.js | = 0.10.22 | No fix listed |
| nodejs node.js | = 0.10.23 | No fix listed |
| nodejs node.js | = 0.10.24 | No fix listed |
| nodejs node.js | = 0.10.25 | No fix listed |
| nodejs node.js | = 0.10.26 | No fix listed |
| nodejs node.js | = 0.10.27 | No fix listed |
| nodejs node.js | = 0.10.28 | No fix listed |
| nodejs node.js | = 0.10.29 | No fix listed |
| nodejs node.js | = 0.10.30 | No fix listed |
| nodejs node.js | = 0.10.31 | No fix listed |
| nodejs node.js | = 0.10.32 | No fix listed |
| nodejs node.js | = 0.10.33 | No fix listed |
| nodejs node.js | = 0.10.34 | No fix listed |
| nodejs node.js | = 0.10.35 | No fix listed |
| nodejs node.js | = 0.10.36 | No fix listed |
| nodejs node.js | = 0.10.37 | No fix listed |
| nodejs node.js | = 0.10.38 | No fix listed |
| nodejs node.js | = 0.10.39 | No fix listed |
| nodejs node.js | = 0.10.40 | No fix listed |
| nodejs node.js | = 0.10.41 | No fix listed |
| nodejs node.js | = 0.10.42 | No fix listed |
| nodejs node.js | = 0.10.43 | No fix listed |
| nodejs node.js | = 0.10.44 | No fix listed |
| nodejs node.js | = 0.10.45 | No fix listed |
| nodejs node.js | = 0.10.46 | No fix listed |
| nodejs node.js | = 0.12.0 | No fix listed |
| nodejs node.js | = 0.12.1 | No fix listed |
| nodejs node.js | = 0.12.2 | No fix listed |
| nodejs node.js | = 0.12.3 | No fix listed |
| nodejs node.js | = 0.12.4 | No fix listed |
| nodejs node.js | = 0.12.5 | No fix listed |
| nodejs node.js | = 0.12.6 | No fix listed |
| nodejs node.js | = 0.12.7 | No fix listed |
| nodejs node.js | = 0.12.8 | No fix listed |
| nodejs node.js | = 0.12.9 | No fix listed |
| nodejs node.js | = 0.12.10 | No fix listed |
| nodejs node.js | = 0.12.11 | No fix listed |
| nodejs node.js | = 0.12.12 | No fix listed |
| nodejs node.js | = 0.12.13 | No fix listed |
| nodejs node.js | = 0.12.14 | No fix listed |
| nodejs node.js | = 0.12.15 | No fix listed |
| nodejs node.js | = 6.0.0 | No fix listed |
| nodejs node.js | = 6.1.0 | No fix listed |
| nodejs node.js | = 6.2.0 | No fix listed |
| nodejs node.js | = 6.2.1 | No fix listed |
| nodejs node.js | = 6.2.2 | No fix listed |
| nodejs node.js | = 6.3.0 | No fix listed |
| nodejs node.js | = 6.3.1 | No fix listed |
| nodejs node.js | = 6.4.0 | No fix listed |
| nodejs node.js | = 6.5.0 | No fix listed |
| nodejs node.js | = 6.6.0 | No fix listed |
| SUSE linux enterprise | = 12.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-5325 vendor-advisory
- SUSE-SU-2016:2470 third-party-advisory vendor-advisory
- RHSA-2017:0002 vendor-advisory
- 93483 vdb-entry
- RHSA-2016:2101 vendor-advisory
- github.com issue-tracking patch
- nodejs.org patch vendor-advisory
- GLSA-201612-43 vendor-advisory
- bugs.debian.org issue-tracking