The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 30, 2017 | Apr 7, 2016 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Apr 7, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 20, 2017 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Oct 30, 2017 | Apr 7, 2016 |
| Suse | — | Upgrade libsoftokn3Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-libharfbuzz0Upgrade mozilla-nss-develUpgrade mozilla-nss-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nspr-32bitUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nss-certsUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozillafirefox-translations-otherUpgrade mozilla-nsprUpgrade mozilla-nss-toolsUpgrade mozilla-nspr-develUpgrade mozillafirefox-translations-commonUpgrade libfreebl3Upgrade libfirefox-gobject-2_0-0Upgrade firefox-atk-langUpgrade mozillafirefoxUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs8Upgrade firefox-libffi4Upgrade mozillafirefox-branding-sledUpgrade firefox-libffi7Upgrade firefox-glib2-toolsUpgrade firefox-libcairo-gobject2Upgrade libfirefox-gio-2_0-0Upgrade firefox-libpango-1_0-0Upgrade firefox-libgtk-3-0Upgrade mozilla-nssUpgrade firefox-gtk3-immodule-ximUpgrade libsoftokn3-32bitUpgrade firefox-gio-branding-upstreamUpgrade nodejs8-docsUpgrade libfirefox-gthread-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade nodejs8-develUpgrade npm8Upgrade firefox-libcairo2Upgrade firefox-gtk3-dataUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfreebl3-32bitUpgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-lang | Apr 7, 2016 | Apr 7, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub