CVE-2016-2216

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2016-04-07

Last modified

2024-08-05

Weaknesses

CWE-20

Affected products

• Fedora (Fedoraproject)
• Node.js (Nodejs)

References

• http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/
• http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html
• http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html
• http://www.securityfocus.com/bid/83141
• https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/
• https://security.gentoo.org/glsa/201612-43