# CVE-2016-9842: Node.js 4 and 1 other: Incorrect Bitwise Shift of Integer

CVE-2016-9842 is fixed in 2 products on 2 platforms, first by rsync 3.1.2-2.1ubuntu1.1, released May 22, 2017. 1 other affected product has no fix yet. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2016-9842
- Priority: High
- CVSS: 8.8 (Low)
- EPSS: 0.0520
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 22, 2017
- Weakness: CWE-1335: Incorrect Bitwise Shift of Integer
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2016-9842

## Description

The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 4 | 4.8.6 | [Node.js 4 4.8.6](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.4-4.8.6.md) | Nov 6, 2017 |
| Linux | rsync Ubuntu 18.04.6 LTS (bionic) | 3.1.2-2.1ubuntu1.1 | [rsync 3.1.2-2.1ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-rsync-3.1.2-2.1ubuntu1.1.md) | May 22, 2017 |
| Linux | rsync Ubuntu 20.04 LTS (focal) | 3.1.3-6 | [rsync 3.1.3-6](https://patchblox.com/security/data/fix/linux/ubuntu-focal-rsync-3.1.3-6.md) | May 22, 2017 |
| Linux | rsync Ubuntu 24.10 (oracular) | 3.1.3-6 | [rsync 3.1.3-6](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-rsync-3.1.3-6.md) | Jan 16, 2026 |
| Linux | rsync Ubuntu 25.04 (plucky) | 3.1.3-6 | [rsync 3.1.3-6](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-rsync-3.1.3-6.md) | Jan 16, 2026 |

## No fix yet

| Platform | Product | Status |
|---|---|---|
| Windows apps | Node.js 7 | no-fix |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo