Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Nov 28, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Nov 28, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node10Upgrade nodeUpgrade node8Upgrade node6 | Dec 10, 2018 | Dec 10, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 28, 2018 |
| Suse | — | Upgrade firefox-libffi7Upgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nssUpgrade libfirefox-glib-2_0-0Upgrade libfreebl3Upgrade mozilla-nspr-32bitUpgrade mozilla-nss-32bitUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-toolsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs4-develUpgrade MozillaFirefox-translations-otherUpgrade nodejs6Upgrade firefox-glib2-toolsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libcairo2Upgrade nodejs8Upgrade firefox-libpango-1_0-0Upgrade mozilla-nsprUpgrade libfirefox-gio-2_0-0Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nss-certs-32bitUpgrade firefox-libgtk-3-0Upgrade libfreebl3-32bitUpgrade nodejs8-develUpgrade npm4Upgrade nodejs6-docsUpgrade mozilla-nss-develUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade libsoftokn3-32bitUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-langUpgrade firefox-libatk-1_0-0Upgrade nodejs4-docsUpgrade MozillaFirefoxUpgrade firefox-libcairo-gobject2Upgrade MozillaFirefox-translations-commonUpgrade firefox-glib2-langUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade libsoftokn3Upgrade nodejs4Upgrade nodejs6-develUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-dataUpgrade firefox-atk-langUpgrade firefox-libharfbuzz0Upgrade firefox-libffi4Upgrade npm8Upgrade firefox-gtk3-immodule-thaiUpgrade npm6Upgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs8-docs | Jan 31, 2019 | Nov 28, 2018 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro) | Mar 22, 2023 | Nov 28, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub