# CVE-2016-5325: Node.js 4: CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47,…

CVE-2016-5325 is fixed in Node.js 4 on 1 platform by Node.js 4 4.6.0 (version 4.6.0), released September 27, 2016. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2016-5325
- Priority: Routine
- CVSS: 6.1
- EPSS: 0.0409
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 10, 2016
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2016-5325

## Description

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 4 | 4.6.0 | [Node.js 4 4.6.0](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.4-4.6.0.md) | Sep 27, 2016 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo