{
  "cveId": "CVE-2016-2216",
  "url": "https://patchblox.com/security/cve/CVE-2016-2216",
  "summary": "CVE-2016-2216 is fixed in Node.js 4 on 1 platform by Node.js 4 4.3.0 (version 4.3.0), released February 9, 2016. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Node.js 4: The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before\u2026",
  "description": "The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.",
  "published": "2016-04-07T21:59:02Z",
  "severity": "",
  "cvss": 7.5,
  "epss": 0.07262,
  "epssPercentile": 0.94374,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2016-2216",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Node.js 4",
      "fixedVersion": "4.3.0",
      "fix": "Node.js 4 4.3.0",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.4-4.3.0",
      "released": "2016-02-09T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T06:34:28Z"
}