CVE-2016-2216
Node.js 4: The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before…
CVE-2016-2216 is fixed in Node.js 4 on 1 platform by Node.js 4 4.3.0 (version 4.3.0), released February 9, 2016. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
7.5
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0726
94th percentile
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.3.0 | Node.js 4 4.3.0 | Feb 9, 2016 |