The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 30, 2017 | Apr 7, 2016 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Apr 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 20, 2017 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Oct 30, 2017 | Apr 7, 2016 |
| Suse | — | Upgrade firefox-libatk-1_0-0Upgrade firefox-glib2-langUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nsprUpgrade libfreebl3Upgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-certsUpgrade mozilla-nss-toolsUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-vietnameseUpgrade mozillafirefox-translations-otherUpgrade mozillafirefox-translations-commonUpgrade firefox-gtk3-immodule-inuktitutUpgrade libsoftokn3Upgrade mozilla-nspr-develUpgrade mozilla-nss-32bitUpgrade mozilla-nspr-32bitUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libcairo2Upgrade mozillafirefoxUpgrade mozilla-nss-certs-32bitUpgrade firefox-gdk-pixbuf-langUpgrade firefox-atk-langUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libffi7Upgrade libfirefox-glib-2_0-0Upgrade npm8Upgrade firefox-libcairo-gobject2Upgrade nodejs8Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfreebl3-32bitUpgrade firefox-glib2-toolsUpgrade mozillafirefox-branding-sledUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-gthread-2_0-0Upgrade nodejs8-develUpgrade nodejs8-docsUpgrade firefox-libffi4Upgrade firefox-gtk3-langUpgrade firefox-gio-branding-upstreamUpgrade libsoftokn3-32bitUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-dataUpgrade firefox-libgtk-3-0Upgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-toolsUpgrade mozilla-nss | Apr 7, 2016 | Apr 7, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub