CVE-2016-2216
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.01%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 7.01% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- nodejs/node.js · fedoraproject/fedora
- Source
- cve@mitre.org
References
- http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/
- http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html
- http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html
- http://www.securityfocus.com/bid/83141
- https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/Patch, Vendor Advisory
- https://security.gentoo.org/glsa/201612-43
- http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/
- http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html
- http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html
- http://www.securityfocus.com/bid/83141
- https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/Patch, Vendor Advisory
- https://security.gentoo.org/glsa/201612-43
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.