Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Nov 28, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Nov 28, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node10Upgrade node8Upgrade nodeUpgrade node6 | Dec 10, 2018 | Dec 10, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 28, 2018 |
| Suse | — | Upgrade libfreebl3Upgrade mozilla-nss-certsUpgrade mozilla-nspr-32bitUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libffi7Upgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-32bitUpgrade nodejs6Upgrade firefox-libpango-1_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libgtk-3-0Upgrade firefox-libcairo2Upgrade nodejs8-develUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nssUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-toolsUpgrade libfirefox-gio-2_0-0Upgrade firefox-glib2-toolsUpgrade firefox-gtk3-immodule-ximUpgrade mozillafirefoxUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gio-branding-upstreamUpgrade mozillafirefox-branding-sledUpgrade nodejs6-docsUpgrade nodejs4-develUpgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nsprUpgrade mozilla-nss-develUpgrade libfreebl3-32bitUpgrade mozillafirefox-translations-otherUpgrade mozillafirefox-translations-commonUpgrade nodejs8Upgrade npm4Upgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-dataUpgrade npm8Upgrade firefox-atk-langUpgrade nodejs4-docsUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libffi4Upgrade npm6Upgrade nodejs4Upgrade firefox-libatk-1_0-0Upgrade firefox-gdk-pixbuf-langUpgrade nodejs6-develUpgrade libsoftokn3Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-langUpgrade libsoftokn3-32bitUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libharfbuzz0Upgrade firefox-glib2-langUpgrade mozilla-nss-toolsUpgrade nodejs8-docsUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-amharic | Jan 31, 2019 | Nov 28, 2018 |
| Ubuntu | — | Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro) | Mar 22, 2023 | Nov 28, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub