The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 30, 2017 | Apr 7, 2016 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Apr 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 20, 2017 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Oct 30, 2017 | Apr 7, 2016 |
| Suse | — | Upgrade mozilla-nss-develUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nspr-32bitUpgrade firefox-glib2-langUpgrade mozilla-nspr-develUpgrade libsoftokn3Upgrade mozilla-nss-toolsUpgrade MozillaFirefoxUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libharfbuzz0Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nss-32bitUpgrade libfreebl3Upgrade mozilla-nss-certsUpgrade mozilla-nsprUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodules-tigrignaUpgrade libfirefox-gthread-2_0-0Upgrade nodejs8-develUpgrade firefox-libffi4Upgrade firefox-libcairo2Upgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-toolsUpgrade firefox-libgtk-3-0Upgrade firefox-libcairo-gobject2Upgrade mozilla-nssUpgrade libfirefox-gio-2_0-0Upgrade firefox-libpango-1_0-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs8Upgrade firefox-glib2-toolsUpgrade firefox-gtk3-dataUpgrade MozillaFirefox-translations-commonUpgrade firefox-libffi7Upgrade firefox-gtk3-langUpgrade libfirefox-glib-2_0-0Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-langUpgrade firefox-atk-langUpgrade libsoftokn3-32bitUpgrade mozilla-nss-certs-32bitUpgrade npm8Upgrade libfirefox-gmodule-2_0-0Upgrade nodejs8-docsUpgrade libfreebl3-32bit | Apr 7, 2016 | Apr 7, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub