CVE-2016-2216
- Source
- https://cve.org/CVERecord?id=CVE-2016-2216
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2216.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2016-2216
- Downstream
- Related
- Published
- 2016-04-07T21:59:02Z
- Modified
- 2026-10-24T10:30:33Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "22" }, { "last_affected": "22" }, { "introduced": "23" }, { "last_affected": "23" } ], "source": "CPE_STRING" } ], "vendor_product": "fedoraproject:fedora" } ] }- References
-
- http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html
- http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html
- http://www.securityfocus.com/bid/83141
- https://security.gentoo.org/glsa/201612-43
- https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/
- http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/
Affected packages
Git / github.com/nodejs/node
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nodejs/node
- Events
-
IntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.0" }, { "last_affected": "0.10.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.1:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.1" }, { "last_affected": "0.10.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.2:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.2" }, { "last_affected": "0.10.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.3:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.3" }, { "last_affected": "0.10.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.4:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.4" }, { "last_affected": "0.10.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.5:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.5" }, { "last_affected": "0.10.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.6:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.6" }, { "last_affected": "0.10.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.7:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.7" }, { "last_affected": "0.10.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.8:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.8" }, { "last_affected": "0.10.8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.9:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.9" }, { "last_affected": "0.10.9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.10:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.10" }, { "last_affected": "0.10.10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.11:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.11" }, { "last_affected": "0.10.11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.12:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.12" }, { "last_affected": "0.10.12" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.13:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.13" }, { "last_affected": "0.10.13" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.14:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.14" }, { "last_affected": "0.10.14" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.15:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.15" }, { "last_affected": "0.10.15" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.16:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.16" }, { "last_affected": "0.10.16" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.16-isaacs-manual:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.16-isaacs-manual" }, { "last_affected": "0.10.16-isaacs-manual" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.17:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.17" }, { "last_affected": "0.10.17" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.18:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.18" }, { "last_affected": "0.10.18" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.19:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.19" }, { "last_affected": "0.10.19" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.20:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.20" }, { "last_affected": "0.10.20" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.21:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.21" }, { "last_affected": "0.10.21" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.22:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.22" }, { "last_affected": "0.10.22" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.23:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.23" }, { "last_affected": "0.10.23" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.24:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.24" }, { "last_affected": "0.10.24" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.25:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.25" }, { "last_affected": "0.10.25" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.26:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.26" }, { "last_affected": "0.10.26" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.27:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.27" }, { "last_affected": "0.10.27" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.28:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.28" }, { "last_affected": "0.10.28" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.29:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.29" }, { "last_affected": "0.10.29" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.30:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.30" }, { "last_affected": "0.10.30" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.31:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.31" }, { "last_affected": "0.10.31" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.32:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.32" }, { "last_affected": "0.10.32" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.33:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.33" }, { "last_affected": "0.10.33" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.34:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.34" }, { "last_affected": "0.10.34" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.35:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.35" }, { "last_affected": "0.10.35" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.36:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.36" }, { "last_affected": "0.10.36" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.37:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.37" }, { "last_affected": "0.10.37" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.38:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.38" }, { "last_affected": "0.10.38" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.39:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.39" }, { "last_affected": "0.10.39" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.40:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.40" }, { "last_affected": "0.10.40" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.10.41:*:*:*:*:*:*:*", "range": [ { "introduced": "0.10.41" }, { "last_affected": "0.10.41" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.6:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.6" }, { "last_affected": "0.11.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.7:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.7" }, { "last_affected": "0.11.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.8:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.8" }, { "last_affected": "0.11.8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.9:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.9" }, { "last_affected": "0.11.9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.10:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.10" }, { "last_affected": "0.11.10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.11:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.11" }, { "last_affected": "0.11.11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.12:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.12" }, { "last_affected": "0.11.12" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.13:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.13" }, { "last_affected": "0.11.13" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.14:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.14" }, { "last_affected": "0.11.14" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.15:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.15" }, { "last_affected": "0.11.15" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.11.16:*:*:*:*:*:*:*", "range": [ { "introduced": "0.11.16" }, { "last_affected": "0.11.16" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.12.0:*:*:*:*:*:*:*", "range": [ { "introduced": "0.12.0" }, { "last_affected": "0.12.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.12.1:*:*:*:*:*:*:*", "range": [ { "introduced": "0.12.1" }, { "last_affected": "0.12.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.12.2:*:*:*:*:*:*:*", "range": [ { "introduced": "0.12.2" }, { "last_affected": "0.12.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.12.3:*:*:*:*:*:*:*", "range": [ { "introduced": "0.12.3" }, { "last_affected": "0.12.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.12.4:*:*:*:*:*:*:*", "range": [ { "introduced": "0.12.4" }, { "last_affected": "0.12.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.12.5:*:*:*:*:*:*:*", "range": [ { "introduced": "0.12.5" }, { "last_affected": "0.12.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.12.6:*:*:*:*:*:*:*", "range": [ { "introduced": "0.12.6" }, { "last_affected": "0.12.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.12.7:*:*:*:*:*:*:*", "range": [ { "introduced": "0.12.7" }, { "last_affected": "0.12.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.12.8:*:*:*:*:*:*:*", "range": [ { "introduced": "0.12.8" }, { "last_affected": "0.12.8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:0.12.9:*:*:*:*:*:*:*", "range": [ { "introduced": "0.12.9" }, { "last_affected": "0.12.9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.0.0:*:*:*:*:*:*:*", "range": [ { "introduced": "4.0.0" }, { "last_affected": "4.0.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.1.0:*:*:*:*:*:*:*", "range": [ { "introduced": "4.1.0" }, { "last_affected": "4.1.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.1.1:*:*:*:*:*:*:*", "range": [ { "introduced": "4.1.1" }, { "last_affected": "4.1.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.1.2:*:*:*:*:*:*:*", "range": [ { "introduced": "4.1.2" }, { "last_affected": "4.1.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.2.0:*:*:*:*:*:*:*", "range": [ { "introduced": "4.2.0" }, { "last_affected": "4.2.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*", "range": [ { "introduced": "4.2.1" }, { "last_affected": "4.2.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.2.2:*:*:*:*:*:*:*", "range": [ { "introduced": "4.2.2" }, { "last_affected": "4.2.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.2.3:*:*:*:*:*:*:*", "range": [ { "introduced": "4.2.3" }, { "last_affected": "4.2.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.2.4:*:*:*:*:*:*:*", "range": [ { "introduced": "4.2.4" }, { "last_affected": "4.2.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.2.5:*:*:*:*:*:*:*", "range": [ { "introduced": "4.2.5" }, { "last_affected": "4.2.5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:4.2.6:*:*:*:*:*:*:*", "range": [ { "introduced": "4.2.6" }, { "last_affected": "4.2.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:5.0.0:*:*:*:*:*:*:*", "range": [ { "introduced": "5.0.0" }, { "last_affected": "5.0.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:5.1.0:*:*:*:*:*:*:*", "range": [ { "introduced": "5.1.0" }, { "last_affected": "5.1.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:5.1.1:*:*:*:*:*:*:*", "range": [ { "introduced": "5.1.1" }, { "last_affected": "5.1.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:5.2.0:*:*:*:*:*:*:*", "range": [ { "introduced": "5.2.0" }, { "last_affected": "5.2.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:5.3.0:*:*:*:*:*:*:*", "range": [ { "introduced": "5.3.0" }, { "last_affected": "5.3.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:5.4.0:*:*:*:*:*:*:*", "range": [ { "introduced": "5.4.0" }, { "last_affected": "5.4.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:5.4.1:*:*:*:*:*:*:*", "range": [ { "introduced": "5.4.1" }, { "last_affected": "5.4.1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:nodejs:node.js:5.5.0:*:*:*:*:*:*:*", "range": [ { "introduced": "5.5.0" }, { "last_affected": "5.5.0" } ], "source": "CPE_STRING" } ] }
Affected versions
0.*
0.10.0
0.10.1
0.10.10
0.10.11
0.10.12
0.10.13
0.10.14
0.10.15
0.10.16
0.10.17
0.10.18
0.10.19
0.10.2
0.10.20
0.10.21
0.10.22
0.10.23
0.10.24
0.10.25
0.10.26
0.10.27
0.10.28
0.10.29
0.10.3
0.10.30
0.10.31
0.10.32
0.10.33
0.10.34
0.10.35
0.10.36
0.10.37
0.10.38
0.10.39
0.10.4
0.10.40
0.10.41
0.10.5
0.10.6
0.10.7
0.10.8
0.10.9
0.11.10
0.11.11
0.11.12
0.11.13
0.11.14
0.11.15
0.11.16
0.11.6
0.11.7
0.11.8
0.11.9
0.12.0
0.12.1
0.12.2
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.8
0.12.9
4.*
4.0.0
4.1.0
4.1.1
4.1.2
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
5.*
5.0.0
5.1.0
5.1.1
5.2.0
5.3.0
5.4.0
5.4.1
5.5.0