Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Nov 28, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Nov 28, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node10Upgrade node8Upgrade nodeUpgrade node6 | Dec 10, 2018 | Dec 10, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 28, 2018 |
| Suse | — | Upgrade firefox-gtk3-branding-upstreamUpgrade mozillafirefoxUpgrade npm4Upgrade nodejs8Upgrade firefox-libcairo2Upgrade mozilla-nss-certsUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs6Upgrade mozillafirefox-translations-otherUpgrade mozilla-nspr-32bitUpgrade libfreebl3Upgrade firefox-libffi7Upgrade libfirefox-glib-2_0-0Upgrade mozilla-nsprUpgrade firefox-libgtk-3-0Upgrade mozilla-nss-certs-32bitUpgrade nodejs8-develUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-toolsUpgrade firefox-gtk3-immodule-ximUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nss-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libpango-1_0-0Upgrade mozillafirefox-translations-commonUpgrade nodejs6-docsUpgrade mozillafirefox-branding-sledUpgrade mozilla-nssUpgrade mozilla-nss-develUpgrade nodejs4-develUpgrade firefox-glib2-toolsUpgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfreebl3-32bitUpgrade firefox-gtk3-langUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libharfbuzz0Upgrade nodejs6-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs4-docsUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gthread-2_0-0Upgrade mozilla-nss-toolsUpgrade npm8Upgrade firefox-atk-langUpgrade firefox-libffi4Upgrade firefox-gtk3-immodule-thaiUpgrade npm6Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-dataUpgrade firefox-libcairo-gobject2Upgrade nodejs4Upgrade libsoftokn3Upgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-amharicUpgrade nodejs8-docsUpgrade firefox-glib2-lang | Jan 31, 2019 | Nov 28, 2018 |
| Ubuntu | — | Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro) | Mar 22, 2023 | Nov 28, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub