CVE-2016-9842
Node.js 4 and 1 other: Incorrect Bitwise Shift of Integer
CVE-2016-9842 is fixed in 2 products on 2 platforms, first by rsync 3.1.2-2.1ubuntu1.1, released May 22, 2017. 1 other affected product has no fix yet. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 2 platforms
CVSS
8.8
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0520
92nd percentile
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 4 | 4.8.6 | Node.js 4 4.8.6 | Nov 6, 2017 |
| Linux | |||
| rsync · Ubuntu 18.04.6 LTS (bionic) | 3.1.2-2.1ubuntu1.1 | rsync 3.1.2-2.1ubuntu1.1 | May 22, 2017 |
| rsync · Ubuntu 20.04 LTS (focal) | 3.1.3-6 | rsync 3.1.3-6 | May 22, 2017 |
| rsync · Ubuntu 24.10 (oracular) | 3.1.3-6 | rsync 3.1.3-6 | Jan 16, 2026 |
| rsync · Ubuntu 25.04 (plucky) | 3.1.3-6 | rsync 3.1.3-6 | Jan 16, 2026 |
| No fix yet | |||
| Node.js 7 (Windows apps) | No fix yet | no-fix | n/a |