HTTP Response Splitting Vulnerability in Node.js Products
CVE-2016-2216

7.5HIGH

Key Information:

Vendor: Nodejs
Status: Node.js
Vendor: CVE Published:; 7 April 2016

What is CVE-2016-2216?

The HTTP header parsing mechanism in various versions of Node.js has a vulnerability that allows attackers to bypass the configured HTTP response-splitting protection. By exploiting UTF-8 encoded Unicode characters in HTTP headers, an adversary can manipulate the application's response behavior. This issue affects specific versions of Node.js, making it critical for users to apply security updates promptly to avoid potential exploitation.