CVE-2016-2216
Node.js HTTP Response Splitting
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
El código de interpretacción de cabecera HTTP en Node.js 0.10.x en versiones anteriores a 0.10.42, 0.11.6 hasta la versión 0.11.16, 0.12.x en versiones anteriores a 0.12.10, 4.x en versiones anteriores a 4.3.0 y 5.x en versiones anteriores a 5.6.0 permite a atacantes remotos eludir un mecanismo de protección de separación de respuesta HTTP a través de caracteres Unicode codificados en UTF-8 en la cabecera HTTP, según lo demonstrado mediante %c4%8d%c4%8a.
Node.js suffers from an HTTP response splitting vulnerability. Node.js versions 5.6.0, 4.3.0, 0.12.10, and 0.10.42 contain a fix for this vulnerability.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-02-03 CVE Reserved
- 2016-02-11 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis | X_refsource_misc | |
| http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf | X_refsource_misc | |
| http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html | X_refsource_misc |
|
| http://www.securityfocus.com/bid/83141 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://nodejs.org/en/blog/vulnerability/february-2016-security-releases | 2017-07-01 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.0 Search vendor "Nodejs" for product "Node.js" and version "0.10.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.1 Search vendor "Nodejs" for product "Node.js" and version "0.10.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.2 Search vendor "Nodejs" for product "Node.js" and version "0.10.2" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.3 Search vendor "Nodejs" for product "Node.js" and version "0.10.3" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.4 Search vendor "Nodejs" for product "Node.js" and version "0.10.4" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.5 Search vendor "Nodejs" for product "Node.js" and version "0.10.5" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.6 Search vendor "Nodejs" for product "Node.js" and version "0.10.6" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.7 Search vendor "Nodejs" for product "Node.js" and version "0.10.7" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.8 Search vendor "Nodejs" for product "Node.js" and version "0.10.8" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.9 Search vendor "Nodejs" for product "Node.js" and version "0.10.9" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.10 Search vendor "Nodejs" for product "Node.js" and version "0.10.10" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.11 Search vendor "Nodejs" for product "Node.js" and version "0.10.11" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.12 Search vendor "Nodejs" for product "Node.js" and version "0.10.12" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.13 Search vendor "Nodejs" for product "Node.js" and version "0.10.13" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.14 Search vendor "Nodejs" for product "Node.js" and version "0.10.14" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.15 Search vendor "Nodejs" for product "Node.js" and version "0.10.15" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.16 Search vendor "Nodejs" for product "Node.js" and version "0.10.16" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.16-isaacs-manual Search vendor "Nodejs" for product "Node.js" and version "0.10.16-isaacs-manual" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.17 Search vendor "Nodejs" for product "Node.js" and version "0.10.17" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.18 Search vendor "Nodejs" for product "Node.js" and version "0.10.18" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.19 Search vendor "Nodejs" for product "Node.js" and version "0.10.19" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.20 Search vendor "Nodejs" for product "Node.js" and version "0.10.20" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.21 Search vendor "Nodejs" for product "Node.js" and version "0.10.21" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.22 Search vendor "Nodejs" for product "Node.js" and version "0.10.22" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.23 Search vendor "Nodejs" for product "Node.js" and version "0.10.23" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.24 Search vendor "Nodejs" for product "Node.js" and version "0.10.24" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.25 Search vendor "Nodejs" for product "Node.js" and version "0.10.25" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.26 Search vendor "Nodejs" for product "Node.js" and version "0.10.26" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.27 Search vendor "Nodejs" for product "Node.js" and version "0.10.27" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.28 Search vendor "Nodejs" for product "Node.js" and version "0.10.28" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.29 Search vendor "Nodejs" for product "Node.js" and version "0.10.29" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.30 Search vendor "Nodejs" for product "Node.js" and version "0.10.30" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.31 Search vendor "Nodejs" for product "Node.js" and version "0.10.31" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.32 Search vendor "Nodejs" for product "Node.js" and version "0.10.32" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.33 Search vendor "Nodejs" for product "Node.js" and version "0.10.33" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.34 Search vendor "Nodejs" for product "Node.js" and version "0.10.34" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.35 Search vendor "Nodejs" for product "Node.js" and version "0.10.35" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.36 Search vendor "Nodejs" for product "Node.js" and version "0.10.36" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.37 Search vendor "Nodejs" for product "Node.js" and version "0.10.37" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.38 Search vendor "Nodejs" for product "Node.js" and version "0.10.38" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.39 Search vendor "Nodejs" for product "Node.js" and version "0.10.39" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.40 Search vendor "Nodejs" for product "Node.js" and version "0.10.40" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.10.41 Search vendor "Nodejs" for product "Node.js" and version "0.10.41" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.6 Search vendor "Nodejs" for product "Node.js" and version "0.11.6" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.7 Search vendor "Nodejs" for product "Node.js" and version "0.11.7" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.8 Search vendor "Nodejs" for product "Node.js" and version "0.11.8" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.9 Search vendor "Nodejs" for product "Node.js" and version "0.11.9" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.10 Search vendor "Nodejs" for product "Node.js" and version "0.11.10" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.11 Search vendor "Nodejs" for product "Node.js" and version "0.11.11" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.12 Search vendor "Nodejs" for product "Node.js" and version "0.11.12" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.13 Search vendor "Nodejs" for product "Node.js" and version "0.11.13" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.14 Search vendor "Nodejs" for product "Node.js" and version "0.11.14" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.15 Search vendor "Nodejs" for product "Node.js" and version "0.11.15" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.11.16 Search vendor "Nodejs" for product "Node.js" and version "0.11.16" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.0 Search vendor "Nodejs" for product "Node.js" and version "0.12.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.1 Search vendor "Nodejs" for product "Node.js" and version "0.12.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.2 Search vendor "Nodejs" for product "Node.js" and version "0.12.2" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.3 Search vendor "Nodejs" for product "Node.js" and version "0.12.3" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.4 Search vendor "Nodejs" for product "Node.js" and version "0.12.4" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.5 Search vendor "Nodejs" for product "Node.js" and version "0.12.5" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.6 Search vendor "Nodejs" for product "Node.js" and version "0.12.6" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.7 Search vendor "Nodejs" for product "Node.js" and version "0.12.7" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.8 Search vendor "Nodejs" for product "Node.js" and version "0.12.8" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 0.12.9 Search vendor "Nodejs" for product "Node.js" and version "0.12.9" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.0.0 Search vendor "Nodejs" for product "Node.js" and version "4.0.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.1.0 Search vendor "Nodejs" for product "Node.js" and version "4.1.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.1.1 Search vendor "Nodejs" for product "Node.js" and version "4.1.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.1.2 Search vendor "Nodejs" for product "Node.js" and version "4.1.2" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.0 Search vendor "Nodejs" for product "Node.js" and version "4.2.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.1 Search vendor "Nodejs" for product "Node.js" and version "4.2.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.2 Search vendor "Nodejs" for product "Node.js" and version "4.2.2" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.3 Search vendor "Nodejs" for product "Node.js" and version "4.2.3" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.4 Search vendor "Nodejs" for product "Node.js" and version "4.2.4" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.5 Search vendor "Nodejs" for product "Node.js" and version "4.2.5" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 4.2.6 Search vendor "Nodejs" for product "Node.js" and version "4.2.6" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.0.0 Search vendor "Nodejs" for product "Node.js" and version "5.0.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.1.0 Search vendor "Nodejs" for product "Node.js" and version "5.1.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.1.1 Search vendor "Nodejs" for product "Node.js" and version "5.1.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.2.0 Search vendor "Nodejs" for product "Node.js" and version "5.2.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.3.0 Search vendor "Nodejs" for product "Node.js" and version "5.3.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.4.0 Search vendor "Nodejs" for product "Node.js" and version "5.4.0" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.4.1 Search vendor "Nodejs" for product "Node.js" and version "5.4.1" | - |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | 5.5.0 Search vendor "Nodejs" for product "Node.js" and version "5.5.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 22 Search vendor "Fedoraproject" for product "Fedora" and version "22" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 23 Search vendor "Fedoraproject" for product "Fedora" and version "23" | - |
Affected
| ||||||