HTTP Response Splitting Vulnerability in Node.js Products
CVE-2016-2216

7.5HIGH

Key Information:

Vendor

Nodejs

Status
Node.js
Vendor
CVE Published:
7 April 2016

What is CVE-2016-2216?

The HTTP header parsing mechanism in various versions of Node.js has a vulnerability that allows attackers to bypass the configured HTTP response-splitting protection. By exploiting UTF-8 encoded Unicode characters in HTTP headers, an adversary can manipulate the application's response behavior. This issue affects specific versions of Node.js, making it critical for users to apply security updates promptly to avoid potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

http://blog.safebreach.com/2016/02/09/http-response-split...
x_refsource_MISC
http://packetstormsecurity.com/files/135711/Node.js-HTTP-...
x_refsource_MISC
http://lists.fedoraproject.org/pipermail/package-announce...
vendor-advisoryx_refsource_FEDORA

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.