The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 30, 2017 | Apr 7, 2016 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Apr 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 20, 2017 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Oct 30, 2017 | Apr 7, 2016 |
| Suse | — | Upgrade mozilla-nss-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nspr-develUpgrade mozillafirefox-translations-otherUpgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-glib2-langUpgrade mozillafirefox-translations-commonUpgrade mozilla-nss-certsUpgrade firefox-libharfbuzz0Upgrade mozilla-nspr-32bitUpgrade libsoftokn3Upgrade mozilla-nss-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade libfreebl3Upgrade mozilla-nsprUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-toolsUpgrade libfirefox-glib-2_0-0Upgrade firefox-atk-langUpgrade firefox-libcairo2Upgrade nodejs8-develUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs8Upgrade firefox-libffi4Upgrade libfirefox-gmodule-2_0-0Upgrade mozillafirefoxUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gdk-pixbuf-query-loadersUpgrade mozillafirefox-branding-sledUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-langUpgrade firefox-libffi7Upgrade firefox-gtk3-dataUpgrade mozilla-nss-certs-32bitUpgrade libsoftokn3-32bitUpgrade firefox-libpango-1_0-0Upgrade nodejs8-docsUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-toolsUpgrade firefox-libgtk-3-0Upgrade firefox-glib2-toolsUpgrade libfreebl3-32bitUpgrade libfirefox-gio-2_0-0Upgrade firefox-libcairo-gobject2Upgrade libfirefox-gthread-2_0-0Upgrade mozilla-nssUpgrade npm8Upgrade firefox-gio-branding-upstream | Apr 7, 2016 | Apr 7, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub