CVE-2016-2216
Gentoo Linux Security Advisory 201612-43
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
El código de interpretacción de cabecera HTTP en Node.js 0.10.x en versiones anteriores a 0.10.42, 0.11.6 hasta la versión 0.11.16, 0.12.x en versiones anteriores a 0.12.10, 4.x en versiones anteriores a 4.3.0 y 5.x en versiones anteriores a 5.6.0 permite a atacantes remotos eludir un mecanismo de protección de separación de respuesta HTTP a través de caracteres Unicode codificados en UTF-8 en la cabecera HTTP, según lo demonstrado mediante %c4%8d%c4%8a.
Multiple vulnerabilities have been found in Node.js, the worst of which can allow remote attackers to cause Denial of Service conditions. Versions less than 4.6.1 are affected.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-02-03 CVE Reserved
- 2016-02-11 CVE Published
- 2016-02-11 First Exploit
- 2024-08-05 CVE Updated
- 2025-04-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis | X_refsource_misc | |
| http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf | X_refsource_misc | |
| http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html | X_refsource_misc |
|
| http://www.securityfocus.com/bid/83141 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/135711 | 2016-02-11 |
| URL | Date | SRC |
|---|---|---|
| https://nodejs.org/en/blog/vulnerability/february-2016-security-releases | 2017-07-01 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.0 Search vendor "Nodejs" for product "Node.js" and version "0.10.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.1 Search vendor "Nodejs" for product "Node.js" and version "0.10.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.2 Search vendor "Nodejs" for product "Node.js" and version "0.10.2" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.3 Search vendor "Nodejs" for product "Node.js" and version "0.10.3" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.4 Search vendor "Nodejs" for product "Node.js" and version "0.10.4" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.5 Search vendor "Nodejs" for product "Node.js" and version "0.10.5" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.6 Search vendor "Nodejs" for product "Node.js" and version "0.10.6" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.7 Search vendor "Nodejs" for product "Node.js" and version "0.10.7" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.8 Search vendor "Nodejs" for product "Node.js" and version "0.10.8" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.9 Search vendor "Nodejs" for product "Node.js" and version "0.10.9" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.10 Search vendor "Nodejs" for product "Node.js" and version "0.10.10" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.11 Search vendor "Nodejs" for product "Node.js" and version "0.10.11" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.12 Search vendor "Nodejs" for product "Node.js" and version "0.10.12" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.13 Search vendor "Nodejs" for product "Node.js" and version "0.10.13" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.14 Search vendor "Nodejs" for product "Node.js" and version "0.10.14" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.15 Search vendor "Nodejs" for product "Node.js" and version "0.10.15" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.16 Search vendor "Nodejs" for product "Node.js" and version "0.10.16" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.16-isaacs-manual Search vendor "Nodejs" for product "Node.js" and version "0.10.16-isaacs-manual" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.17 Search vendor "Nodejs" for product "Node.js" and version "0.10.17" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.18 Search vendor "Nodejs" for product "Node.js" and version "0.10.18" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.19 Search vendor "Nodejs" for product "Node.js" and version "0.10.19" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.20 Search vendor "Nodejs" for product "Node.js" and version "0.10.20" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.21 Search vendor "Nodejs" for product "Node.js" and version "0.10.21" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.22 Search vendor "Nodejs" for product "Node.js" and version "0.10.22" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.23 Search vendor "Nodejs" for product "Node.js" and version "0.10.23" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.24 Search vendor "Nodejs" for product "Node.js" and version "0.10.24" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.25 Search vendor "Nodejs" for product "Node.js" and version "0.10.25" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.26 Search vendor "Nodejs" for product "Node.js" and version "0.10.26" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.27 Search vendor "Nodejs" for product "Node.js" and version "0.10.27" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.28 Search vendor "Nodejs" for product "Node.js" and version "0.10.28" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.29 Search vendor "Nodejs" for product "Node.js" and version "0.10.29" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.30 Search vendor "Nodejs" for product "Node.js" and version "0.10.30" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.31 Search vendor "Nodejs" for product "Node.js" and version "0.10.31" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.32 Search vendor "Nodejs" for product "Node.js" and version "0.10.32" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.33 Search vendor "Nodejs" for product "Node.js" and version "0.10.33" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.34 Search vendor "Nodejs" for product "Node.js" and version "0.10.34" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.35 Search vendor "Nodejs" for product "Node.js" and version "0.10.35" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.36 Search vendor "Nodejs" for product "Node.js" and version "0.10.36" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.37 Search vendor "Nodejs" for product "Node.js" and version "0.10.37" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.38 Search vendor "Nodejs" for product "Node.js" and version "0.10.38" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.39 Search vendor "Nodejs" for product "Node.js" and version "0.10.39" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.40 Search vendor "Nodejs" for product "Node.js" and version "0.10.40" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.41 Search vendor "Nodejs" for product "Node.js" and version "0.10.41" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.6 Search vendor "Nodejs" for product "Node.js" and version "0.11.6" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.7 Search vendor "Nodejs" for product "Node.js" and version "0.11.7" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.8 Search vendor "Nodejs" for product "Node.js" and version "0.11.8" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.9 Search vendor "Nodejs" for product "Node.js" and version "0.11.9" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.10 Search vendor "Nodejs" for product "Node.js" and version "0.11.10" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.11 Search vendor "Nodejs" for product "Node.js" and version "0.11.11" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.12 Search vendor "Nodejs" for product "Node.js" and version "0.11.12" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.13 Search vendor "Nodejs" for product "Node.js" and version "0.11.13" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.14 Search vendor "Nodejs" for product "Node.js" and version "0.11.14" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.15 Search vendor "Nodejs" for product "Node.js" and version "0.11.15" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.16 Search vendor "Nodejs" for product "Node.js" and version "0.11.16" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.0 Search vendor "Nodejs" for product "Node.js" and version "0.12.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.1 Search vendor "Nodejs" for product "Node.js" and version "0.12.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.2 Search vendor "Nodejs" for product "Node.js" and version "0.12.2" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.3 Search vendor "Nodejs" for product "Node.js" and version "0.12.3" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.4 Search vendor "Nodejs" for product "Node.js" and version "0.12.4" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.5 Search vendor "Nodejs" for product "Node.js" and version "0.12.5" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.6 Search vendor "Nodejs" for product "Node.js" and version "0.12.6" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.7 Search vendor "Nodejs" for product "Node.js" and version "0.12.7" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.8 Search vendor "Nodejs" for product "Node.js" and version "0.12.8" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.9 Search vendor "Nodejs" for product "Node.js" and version "0.12.9" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.0.0 Search vendor "Nodejs" for product "Node.js" and version "4.0.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.1.0 Search vendor "Nodejs" for product "Node.js" and version "4.1.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.1.1 Search vendor "Nodejs" for product "Node.js" and version "4.1.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.1.2 Search vendor "Nodejs" for product "Node.js" and version "4.1.2" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.0 Search vendor "Nodejs" for product "Node.js" and version "4.2.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.1 Search vendor "Nodejs" for product "Node.js" and version "4.2.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.2 Search vendor "Nodejs" for product "Node.js" and version "4.2.2" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.3 Search vendor "Nodejs" for product "Node.js" and version "4.2.3" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.4 Search vendor "Nodejs" for product "Node.js" and version "4.2.4" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.5 Search vendor "Nodejs" for product "Node.js" and version "4.2.5" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.6 Search vendor "Nodejs" for product "Node.js" and version "4.2.6" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.0.0 Search vendor "Nodejs" for product "Node.js" and version "5.0.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.1.0 Search vendor "Nodejs" for product "Node.js" and version "5.1.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.1.1 Search vendor "Nodejs" for product "Node.js" and version "5.1.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.2.0 Search vendor "Nodejs" for product "Node.js" and version "5.2.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.3.0 Search vendor "Nodejs" for product "Node.js" and version "5.3.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.4.0 Search vendor "Nodejs" for product "Node.js" and version "5.4.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.4.1 Search vendor "Nodejs" for product "Node.js" and version "5.4.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.5.0 Search vendor "Nodejs" for product "Node.js" and version "5.5.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 22 Search vendor "Fedoraproject" for product "Fedora" and version "22" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 23 Search vendor "Fedoraproject" for product "Fedora" and version "23" | - |
Affected
| ||||||