The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 30, 2017 | Apr 7, 2016 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Apr 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 20, 2017 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Oct 30, 2017 | Apr 7, 2016 |
| Suse | — | Upgrade libfreebl3Upgrade libsoftokn3Upgrade firefox-glib2-langUpgrade mozilla-nss-develUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-libatk-1_0-0Upgrade mozilla-nspr-develUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nss-32bitUpgrade mozilla-nss-certsUpgrade mozilla-nsprUpgrade firefox-gtk3-immodule-vietnameseUpgrade MozillaFirefoxUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-branding-upstreamUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-glib2-toolsUpgrade libfirefox-gio-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-libffi7Upgrade npm8Upgrade firefox-atk-langUpgrade firefox-gtk3-toolsUpgrade firefox-libgtk-3-0Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-libffi4Upgrade firefox-gtk3-langUpgrade firefox-libcairo-gobject2Upgrade firefox-libpango-1_0-0Upgrade firefox-gdk-pixbuf-langUpgrade MozillaFirefox-translations-commonUpgrade firefox-libcairo2Upgrade firefox-gtk3-immodule-ximUpgrade mozilla-nss-certs-32bitUpgrade libsoftokn3-32bitUpgrade nodejs8-develUpgrade nodejs8-docsUpgrade nodejs8Upgrade libfirefox-gthread-2_0-0Upgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nssUpgrade libfreebl3-32bitUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-data | Apr 7, 2016 | Apr 7, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub