# CVE-2016-2216: Node.js 4: The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before…

CVE-2016-2216 is fixed in Node.js 4 on 1 platform by Node.js 4 4.3.0 (version 4.3.0), released February 9, 2016. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2016-2216
- Priority: High
- CVSS: 7.5
- EPSS: 0.0726
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 7, 2016
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2016-2216

## Description

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 4 | 4.3.0 | [Node.js 4 4.3.0](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.4-4.3.0.md) | Feb 9, 2016 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo