CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Oct 10, 2016 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Oct 30, 2017 | Oct 10, 2016 |
| Redhat Openshift | — | Upgrade nodejs-tough-cookieUpgrade nodejs | Jun 18, 2018 | Jun 13, 2016 |
| Suse | — | Upgrade mozilla-nss-certs-32bitUpgrade firefox-libpango-1_0-0Upgrade firefox-libcairo2Upgrade firefox-libffi7Upgrade firefox-gtk3-dataUpgrade firefox-libffi4Upgrade libfirefox-gthread-2_0-0Upgrade libsoftokn3-32bitUpgrade npm8Upgrade libfirefox-glib-2_0-0Upgrade firefox-libcairo-gobject2Upgrade firefox-libgtk-3-0Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-gio-branding-upstreamUpgrade nodejs4Upgrade firefox-atk-langUpgrade libfirefox-gobject-2_0-0Upgrade mozilla-nsprUpgrade nodejs8Upgrade firefox-glib2-toolsUpgrade mozilla-nssUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade MozillaFirefox-branding-SLEDUpgrade nodejs8-docsUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs8-develUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfreebl3-32bitUpgrade MozillaFirefox-translations-commonUpgrade libfirefox-gio-2_0-0Upgrade firefox-libharfbuzz0Upgrade libsoftokn3Upgrade mozilla-nss-32bitUpgrade nodejs4-develUpgrade mozilla-nspr-develUpgrade libfreebl3Upgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-certsUpgrade mozilla-nss-toolsUpgrade nodejs4-docsUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-glib2-langUpgrade mozilla-nss-develUpgrade npm4Upgrade mozilla-nspr-32bitUpgrade MozillaFirefoxUpgrade firefox-gtk3-langUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libatk-1_0-0Upgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-tools | Oct 12, 2016 | Oct 6, 2016 |
| Ubuntu | — | Upgrade nodejs | Nov 19, 2024 | Oct 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub