CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Oct 10, 2016 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Oct 30, 2017 | Oct 10, 2016 |
| Redhat Openshift | — | Upgrade nodejs-tough-cookieUpgrade nodejs | Jun 18, 2018 | Jun 13, 2016 |
| Suse | — | Upgrade firefox-gtk3-dataUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nsprUpgrade nodejs8-develUpgrade firefox-libffi4Upgrade firefox-libffi7Upgrade libfreebl3-32bitUpgrade libfirefox-gthread-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-branding-upstreamUpgrade nodejs4Upgrade firefox-atk-langUpgrade libfirefox-glib-2_0-0Upgrade firefox-libgtk-3-0Upgrade mozilla-nssUpgrade nodejs8Upgrade firefox-gdk-pixbuf-query-loadersUpgrade libsoftokn3-32bitUpgrade firefox-libcairo-gobject2Upgrade npm8Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-inuktitutUpgrade MozillaFirefox-translations-commonUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libcairo2Upgrade libfirefox-gobject-2_0-0Upgrade firefox-libpango-1_0-0Upgrade nodejs8-docsUpgrade firefox-gdk-pixbuf-langUpgrade MozillaFirefox-branding-SLEDUpgrade libfirefox-gio-2_0-0Upgrade firefox-glib2-toolsUpgrade mozilla-nss-certsUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-32bitUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-ximUpgrade MozillaFirefox-translations-otherUpgrade firefox-libharfbuzz0Upgrade npm4Upgrade nodejs4-develUpgrade firefox-gtk3-langUpgrade MozillaFirefoxUpgrade nodejs4-docsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade libsoftokn3Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-toolsUpgrade libfreebl3Upgrade mozilla-nss-toolsUpgrade mozilla-nspr-develUpgrade firefox-libatk-1_0-0Upgrade mozilla-nspr-32bitUpgrade mozilla-nss-devel | Oct 12, 2016 | Oct 6, 2016 |
| Ubuntu | — | Upgrade nodejs | Nov 19, 2024 | Oct 10, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub