CVE-2016-5325
Node.js 4: CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47,…
CVE-2016-5325 is fixed in Node.js 4 on 1 platform by Node.js 4 4.6.0 (version 4.6.0), released September 27, 2016. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
6.1
No vendor severity
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0409
90th percentile
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.6.0 | Node.js 4 4.6.0 | Sep 27, 2016 |