CVE-2016-2086
Node.js 4: Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote…
CVE-2016-2086 is fixed in Node.js 4 on 1 platform by Node.js 4 4.3.0 (version 4.3.0), released February 9, 2016. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
7.5
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0626
93rd percentile
Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.3.0 | Node.js 4 4.3.0 | Feb 9, 2016 |