Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Nov 28, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Nov 28, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node10Upgrade node8Upgrade node6Upgrade node | Dec 10, 2018 | Dec 10, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 28, 2018 |
| Suse | — | Upgrade libfirefox-glib-2_0-0Upgrade libfreebl3-32bitUpgrade firefox-libffi7Upgrade nodejs6-docsUpgrade npm4Upgrade firefox-gtk3-branding-upstreamUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-libpango-1_0-0Upgrade firefox-libcairo2Upgrade nodejs8Upgrade libfreebl3Upgrade mozilla-nss-certsUpgrade firefox-glib2-toolsUpgrade nodejs6Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nspr-32bitUpgrade nodejs4-develUpgrade mozilla-nsprUpgrade mozilla-nss-develUpgrade nodejs8-develUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade firefox-libgtk-3-0Upgrade mozilla-nss-32bitUpgrade firefox-gtk3-toolsUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-gio-branding-upstreamUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade MozillaFirefox-translations-otherUpgrade mozilla-nssUpgrade npm6Upgrade MozillaFirefox-translations-commonUpgrade firefox-libatk-1_0-0Upgrade firefox-libcairo-gobject2Upgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-libharfbuzz0Upgrade mozilla-nss-toolsUpgrade firefox-atk-langUpgrade MozillaFirefoxUpgrade nodejs6-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libffi4Upgrade firefox-gtk3-langUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-multipressUpgrade nodejs4Upgrade firefox-gdk-pixbuf-langUpgrade npm8Upgrade nodejs4-docsUpgrade firefox-glib2-langUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-thaiUpgrade libfirefox-gthread-2_0-0Upgrade libsoftokn3Upgrade nodejs8-docs | Jan 31, 2019 | Nov 28, 2018 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro) | Mar 22, 2023 | Nov 28, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub