The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 30, 2017 | Apr 7, 2016 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Apr 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 20, 2017 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Oct 30, 2017 | Apr 7, 2016 |
| Suse | — | Upgrade npm8Upgrade firefox-libffi4Upgrade firefox-libgtk-3-0Upgrade nodejs8-docsUpgrade firefox-libcairo2Upgrade libfreebl3-32bitUpgrade firefox-libpango-1_0-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-toolsUpgrade firefox-gtk3-dataUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade nodejs8Upgrade mozilla-nss-certs-32bitUpgrade MozillaFirefox-translations-commonUpgrade firefox-gtk3-langUpgrade firefox-libcairo-gobject2Upgrade libfirefox-gthread-2_0-0Upgrade firefox-gio-branding-upstreamUpgrade mozilla-nssUpgrade libsoftokn3-32bitUpgrade firefox-libffi7Upgrade firefox-glib2-toolsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs8-develUpgrade firefox-atk-langUpgrade libfirefox-glib-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade libsoftokn3Upgrade mozilla-nss-develUpgrade MozillaFirefoxUpgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-multipressUpgrade libfreebl3Upgrade mozilla-nss-32bitUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nsprUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-glib2-langUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-branding-upstreamUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-toolsUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nspr-devel | Apr 7, 2016 | Apr 7, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub