# CVE-2016-9841: Node.js 4 and 1 other: inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging…

CVE-2016-9841 is fixed in 4 products on 2 platforms, first by klibc-utils 2.0.13-4ubuntu1, released May 22, 2017. 1 other affected product has no fix yet. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2016-9841
- Priority: High
- CVSS: 9.8 (Low)
- EPSS: 0.0755
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 22, 2017
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2016-9841

## Description

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 4 | 4.8.6 | [Node.js 4 4.8.6](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.4-4.8.6.md) | Nov 6, 2017 |
| Linux | klibc-utils Ubuntu 18.04.6 LTS (bionic) | 2.0.4-9ubuntu2.2+esm1 | [klibc-utils 2.0.4-9ubuntu2.2+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-klibc-utils-2.0.4-9ubuntu2.2-esm1.md) | Aug 5, 2022 |
| Linux | klibc-utils Ubuntu 20.04 LTS (focal) | 2.0.7-1ubuntu5.2 | [klibc-utils 2.0.7-1ubuntu5.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-klibc-utils-2.0.7-1ubuntu5.2.md) | Aug 5, 2022 |
| Linux | klibc-utils Ubuntu 22.04.1 LTS (jammy) | 2.0.10-4ubuntu0.1 | [klibc-utils 2.0.10-4ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-klibc-utils-2.0.10-4ubuntu0.1.md) | Aug 5, 2022 |
| Linux | klibc-utils Ubuntu 24.04.5 LTS (noble) | 2.0.13-4ubuntu0.1 | [klibc-utils 2.0.13-4ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-klibc-utils-2.0.13-4ubuntu0.1.md) | Aug 5, 2022 |
| Linux | klibc-utils Ubuntu 24.10 (oracular) | 2.0.13-4ubuntu1 | [klibc-utils 2.0.13-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-klibc-utils-2.0.13-4ubuntu1.md) | Jan 16, 2026 |
| Linux | klibc-utils Ubuntu 25.04 (plucky) | 2.0.13-4ubuntu1 | [klibc-utils 2.0.13-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-klibc-utils-2.0.13-4ubuntu1.md) | Jan 16, 2026 |
| Linux | klibc-utils Ubuntu 25.10 (questing) | 2.0.13-4ubuntu1 | [klibc-utils 2.0.13-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-klibc-utils-2.0.13-4ubuntu1.md) | May 22, 2017 |
| Linux | libklibc Ubuntu 18.04.6 LTS (bionic) | 2.0.4-9ubuntu2.2+esm1 | [libklibc 2.0.4-9ubuntu2.2+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libklibc-2.0.4-9ubuntu2.2-esm1.md) | Aug 5, 2022 |
| Linux | libklibc Ubuntu 20.04 LTS (focal) | 2.0.7-1ubuntu5.2 | [libklibc 2.0.7-1ubuntu5.2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libklibc-2.0.7-1ubuntu5.2.md) | Aug 5, 2022 |
| Linux | libklibc Ubuntu 22.04.1 LTS (jammy) | 2.0.10-4ubuntu0.1 | [libklibc 2.0.10-4ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libklibc-2.0.10-4ubuntu0.1.md) | Aug 5, 2022 |
| Linux | libklibc Ubuntu 24.04.5 LTS (noble) | 2.0.13-4ubuntu0.1 | [libklibc 2.0.13-4ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libklibc-2.0.13-4ubuntu0.1.md) | Aug 5, 2022 |
| Linux | libklibc Ubuntu 24.10 (oracular) | 2.0.13-4ubuntu1 | [libklibc 2.0.13-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libklibc-2.0.13-4ubuntu1.md) | Jan 16, 2026 |
| Linux | libklibc Ubuntu 25.04 (plucky) | 2.0.13-4ubuntu1 | [libklibc 2.0.13-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libklibc-2.0.13-4ubuntu1.md) | Jan 16, 2026 |
| Linux | libklibc Ubuntu 25.10 (questing) | 2.0.13-4ubuntu1 | [libklibc 2.0.13-4ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libklibc-2.0.13-4ubuntu1.md) | May 22, 2017 |
| Linux | rsync Ubuntu 18.04.6 LTS (bionic) | 3.1.2-2.1ubuntu1.1 | [rsync 3.1.2-2.1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-rsync-3.1.2-2.1ubuntu1.1.md) | May 22, 2017 |
| Linux | rsync Ubuntu 20.04 LTS (focal) | 3.1.3-6 | [rsync 3.1.3-6](https://patchblox.com/security/data/fix/linux/ubuntu-focal-rsync-3.1.3-6.md) | May 22, 2017 |
| Linux | rsync Ubuntu 24.10 (oracular) | 3.1.3-6 | [rsync 3.1.3-6](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-rsync-3.1.3-6.md) | Jan 16, 2026 |
| Linux | rsync Ubuntu 25.04 (plucky) | 3.1.3-6 | [rsync 3.1.3-6](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-rsync-3.1.3-6.md) | Jan 16, 2026 |

## No fix yet

| Platform | Product | Status |
|---|---|---|
| Windows apps | Node.js 7 | no-fix |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo