Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Nov 28, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Nov 28, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node8Upgrade nodeUpgrade node6Upgrade node10 | Dec 10, 2018 | Dec 10, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 28, 2018 |
| Suse | — | Upgrade nodejs4-docsUpgrade libsoftokn3Upgrade nodejs4Upgrade nodejs6-develUpgrade firefox-gtk3-dataUpgrade mozilla-nss-toolsUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libatk-1_0-0Upgrade firefox-libcairo-gobject2Upgrade MozillaFirefox-translations-commonUpgrade MozillaFirefoxUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-glib2-langUpgrade npm8Upgrade firefox-libffi4Upgrade npm6Upgrade libfirefox-gthread-2_0-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-atk-langUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-langUpgrade libsoftokn3-32bitUpgrade nodejs8-docsUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs6-docsUpgrade firefox-glib2-toolsUpgrade firefox-libcairo2Upgrade mozilla-nsprUpgrade libfreebl3Upgrade mozilla-nss-certsUpgrade nodejs4-develUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libffi7Upgrade npm4Upgrade mozilla-nspr-32bitUpgrade mozilla-nss-develUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libgtk-3-0Upgrade mozilla-nss-certs-32bitUpgrade nodejs8-develUpgrade firefox-gio-branding-upstreamUpgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-ximUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-toolsUpgrade firefox-libpango-1_0-0Upgrade libfirefox-gio-2_0-0Upgrade nodejs8Upgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-32bitUpgrade mozilla-nssUpgrade MozillaFirefox-translations-otherUpgrade nodejs6Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0 | Jan 31, 2019 | Nov 28, 2018 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro) | Mar 22, 2023 | Nov 28, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub