CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Oct 10, 2016 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Oct 30, 2017 | Oct 10, 2016 |
| Redhat Openshift | — | Upgrade nodejsUpgrade nodejs-tough-cookie | Jun 18, 2018 | Jun 13, 2016 |
| Suse | — | Upgrade libfirefox-gthread-2_0-0Upgrade nodejs8-develUpgrade firefox-gdk-pixbuf-langUpgrade npm8Upgrade firefox-gtk3-dataUpgrade firefox-libffi7Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs4Upgrade firefox-glib2-toolsUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfirefox-gio-2_0-0Upgrade nodejs8Upgrade libfreebl3-32bitUpgrade mozilla-nssUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libgtk-3-0Upgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nsprUpgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libffi4Upgrade firefox-libcairo2Upgrade firefox-libpango-1_0-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gobject-2_0-0Upgrade MozillaFirefox-translations-commonUpgrade libfirefox-glib-2_0-0Upgrade firefox-atk-langUpgrade nodejs8-docsUpgrade npm4Upgrade mozilla-nspr-develUpgrade mozilla-nss-develUpgrade MozillaFirefoxUpgrade mozilla-nss-toolsUpgrade libsoftokn3Upgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libatk-1_0-0Upgrade libfreebl3Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-toolsUpgrade mozilla-nspr-32bitUpgrade nodejs4-develUpgrade firefox-libharfbuzz0Upgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nss-32bitUpgrade nodejs4-docsUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-immodule-amharic | Oct 12, 2016 | Oct 6, 2016 |
| Ubuntu | — | Upgrade nodejs | Nov 19, 2024 | Oct 10, 2016 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub