Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Nov 28, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Nov 28, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node10Upgrade node6Upgrade node8Upgrade node | Dec 10, 2018 | Dec 10, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 28, 2018 |
| Suse | — | Upgrade nodejs6-docsUpgrade firefox-gio-branding-upstreamUpgrade libfirefox-gmodule-2_0-0Upgrade libfreebl3-32bitUpgrade nodejs6Upgrade firefox-glib2-toolsUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-toolsUpgrade libfirefox-glib-2_0-0Upgrade mozillafirefox-branding-sledUpgrade mozillafirefoxUpgrade nodejs4-develUpgrade firefox-gtk3-immodule-ximUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-32bitUpgrade mozilla-nssUpgrade firefox-libffi7Upgrade mozilla-nss-develUpgrade firefox-libcairo2Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nsprUpgrade firefox-libpango-1_0-0Upgrade mozilla-nss-certsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade npm4Upgrade libfreebl3Upgrade nodejs8Upgrade mozillafirefox-translations-commonUpgrade libfirefox-gobject-2_0-0Upgrade nodejs8-develUpgrade mozillafirefox-translations-otherUpgrade mozilla-nss-certs-32bitUpgrade firefox-libgtk-3-0Upgrade nodejs6-develUpgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-dataUpgrade libsoftokn3Upgrade firefox-gtk3-langUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs8-docsUpgrade nodejs4-docsUpgrade firefox-gdk-pixbuf-langUpgrade libsoftokn3-32bitUpgrade firefox-glib2-langUpgrade firefox-libatk-1_0-0Upgrade firefox-libharfbuzz0Upgrade mozilla-nss-toolsUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-immodule-thaiUpgrade npm6Upgrade firefox-atk-langUpgrade npm8Upgrade firefox-libffi4Upgrade nodejs4 | Jan 31, 2019 | Nov 28, 2018 |
| Ubuntu | — | Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro) | Mar 22, 2023 | Nov 28, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub