VulnerabilityModified
CVE-2016-5325
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response…
MEDIUM 6.1EPSS 4.09%
Does this matter?
Lower severity and a low EPSS score (4.09%). Track it; it rarely justifies an emergency change on its own.
Description
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 4.09% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-113
- Affected
- nodejs/node.js · suse/linux enterprise
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.securityfocus.com/bid/93483
- https://access.redhat.com/errata/RHSA-2016:2101
- https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762Issue Tracking, Patch
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/Patch, Vendor Advisory
- https://security.gentoo.org/glsa/201612-43
- http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0002.html
- http://www.securityfocus.com/bid/93483
- https://access.redhat.com/errata/RHSA-2016:2101
- https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762Issue Tracking, Patch
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/Patch, Vendor Advisory
- https://security.gentoo.org/glsa/201612-43
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.