CVE-2016-3956
Node.js 4: The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before…
CVE-2016-3956 is fixed in 2 products on 2 platforms, first by Node.js 4 4.4.2, released April 1, 2016. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 2 platforms
CVSS
7.5
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0546
92nd percentile
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.4.2 | Node.js 4 4.4.2 | Apr 1, 2016 |
| Linux | |||
| npm · Ubuntu 18.04.6 LTS (bionic) | 3.5.2-0ubuntu4.1.18.04.1~esm1 | npm 3.5.2-0ubuntu4.1.18.04.1~esm1 | Jul 2, 2016 |