CVE-2016-7099

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-7099
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-7099.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2016-7099
Downstream
Related
Published
2016-10-10T16:59:01.277Z
Modified
2026-07-10T12:01:07.405352840Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "0.10.0"
                },
                {
                    "last_affected": "0.10.0"
                },
                {
                    "introduced": "0.10.1"
                },
                {
                    "last_affected": "0.10.1"
                },
                {
                    "introduced": "0.10.2"
                },
                {
                    "last_affected": "0.10.2"
                },
                {
                    "introduced": "0.10.3"
                },
                {
                    "last_affected": "0.10.3"
                },
                {
                    "introduced": "0.10.4"
                },
                {
                    "last_affected": "0.10.4"
                },
                {
                    "introduced": "0.10.5"
                },
                {
                    "last_affected": "0.10.5"
                },
                {
                    "introduced": "0.10.6"
                },
                {
                    "last_affected": "0.10.6"
                },
                {
                    "introduced": "0.10.7"
                },
                {
                    "last_affected": "0.10.7"
                },
                {
                    "introduced": "0.10.8"
                },
                {
                    "last_affected": "0.10.8"
                },
                {
                    "introduced": "0.10.9"
                },
                {
                    "last_affected": "0.10.9"
                },
                {
                    "introduced": "0.10.10"
                },
                {
                    "last_affected": "0.10.10"
                },
                {
                    "introduced": "0.10.11"
                },
                {
                    "last_affected": "0.10.11"
                },
                {
                    "introduced": "0.10.12"
                },
                {
                    "last_affected": "0.10.12"
                },
                {
                    "introduced": "0.10.13"
                },
                {
                    "last_affected": "0.10.13"
                },
                {
                    "introduced": "0.10.14"
                },
                {
                    "last_affected": "0.10.14"
                },
                {
                    "introduced": "0.10.15"
                },
                {
                    "last_affected": "0.10.15"
                },
                {
                    "introduced": "0.10.16"
                },
                {
                    "last_affected": "0.10.16"
                },
                {
                    "introduced": "0.10.16-isaacs-manual"
                },
                {
                    "last_affected": "0.10.16-isaacs-manual"
                },
                {
                    "introduced": "0.10.17"
                },
                {
                    "last_affected": "0.10.17"
                },
                {
                    "introduced": "0.10.18"
                },
                {
                    "last_affected": "0.10.18"
                },
                {
                    "introduced": "0.10.19"
                },
                {
                    "last_affected": "0.10.19"
                },
                {
                    "introduced": "0.10.20"
                },
                {
                    "last_affected": "0.10.20"
                },
                {
                    "introduced": "0.10.21"
                },
                {
                    "last_affected": "0.10.21"
                },
                {
                    "introduced": "0.10.22"
                },
                {
                    "last_affected": "0.10.22"
                },
                {
                    "introduced": "0.10.23"
                },
                {
                    "last_affected": "0.10.23"
                },
                {
                    "introduced": "0.10.24"
                },
                {
                    "last_affected": "0.10.24"
                },
                {
                    "introduced": "0.10.25"
                },
                {
                    "last_affected": "0.10.25"
                },
                {
                    "introduced": "0.10.26"
                },
                {
                    "last_affected": "0.10.26"
                },
                {
                    "introduced": "0.10.27"
                },
                {
                    "last_affected": "0.10.27"
                },
                {
                    "introduced": "0.10.28"
                },
                {
                    "last_affected": "0.10.28"
                },
                {
                    "introduced": "0.10.29"
                },
                {
                    "last_affected": "0.10.29"
                },
                {
                    "introduced": "0.10.30"
                },
                {
                    "last_affected": "0.10.30"
                },
                {
                    "introduced": "0.10.31"
                },
                {
                    "last_affected": "0.10.31"
                },
                {
                    "introduced": "0.10.32"
                },
                {
                    "last_affected": "0.10.32"
                },
                {
                    "introduced": "0.10.33"
                },
                {
                    "last_affected": "0.10.33"
                },
                {
                    "introduced": "0.10.34"
                },
                {
                    "last_affected": "0.10.34"
                },
                {
                    "introduced": "0.10.35"
                },
                {
                    "last_affected": "0.10.35"
                },
                {
                    "introduced": "0.10.36"
                },
                {
                    "last_affected": "0.10.36"
                },
                {
                    "introduced": "0.10.37"
                },
                {
                    "last_affected": "0.10.37"
                },
                {
                    "introduced": "0.10.38"
                },
                {
                    "last_affected": "0.10.38"
                },
                {
                    "introduced": "0.10.39"
                },
                {
                    "last_affected": "0.10.39"
                },
                {
                    "introduced": "0.10.40"
                },
                {
                    "last_affected": "0.10.40"
                },
                {
                    "introduced": "0.10.41"
                },
                {
                    "last_affected": "0.10.41"
                },
                {
                    "introduced": "0.10.42"
                },
                {
                    "last_affected": "0.10.42"
                },
                {
                    "introduced": "0.10.43"
                },
                {
                    "last_affected": "0.10.43"
                },
                {
                    "introduced": "0.10.44"
                },
                {
                    "last_affected": "0.10.44"
                },
                {
                    "introduced": "0.10.45"
                },
                {
                    "last_affected": "0.10.45"
                },
                {
                    "introduced": "0.10.46"
                },
                {
                    "last_affected": "0.10.46"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "last_affected": "6.0.0"
                },
                {
                    "introduced": "6.1.0"
                },
                {
                    "last_affected": "6.1.0"
                },
                {
                    "introduced": "6.2.0"
                },
                {
                    "last_affected": "6.2.0"
                },
                {
                    "introduced": "6.2.1"
                },
                {
                    "last_affected": "6.2.1"
                },
                {
                    "introduced": "6.2.2"
                },
                {
                    "last_affected": "6.2.2"
                },
                {
                    "introduced": "6.3.0"
                },
                {
                    "last_affected": "6.3.0"
                },
                {
                    "introduced": "6.3.1"
                },
                {
                    "last_affected": "6.3.1"
                },
                {
                    "introduced": "6.4.0"
                },
                {
                    "last_affected": "6.4.0"
                },
                {
                    "introduced": "6.5.0"
                },
                {
                    "last_affected": "6.5.0"
                },
                {
                    "introduced": "6.6.0"
                },
                {
                    "last_affected": "6.6.0"
                },
                {
                    "introduced": "0.12.0"
                },
                {
                    "last_affected": "0.12.0"
                },
                {
                    "introduced": "0.12.1"
                },
                {
                    "last_affected": "0.12.1"
                },
                {
                    "introduced": "0.12.2"
                },
                {
                    "last_affected": "0.12.2"
                },
                {
                    "introduced": "0.12.3"
                },
                {
                    "last_affected": "0.12.3"
                },
                {
                    "introduced": "0.12.4"
                },
                {
                    "last_affected": "0.12.4"
                },
                {
                    "introduced": "0.12.5"
                },
                {
                    "last_affected": "0.12.5"
                },
                {
                    "introduced": "0.12.6"
                },
                {
                    "last_affected": "0.12.6"
                },
                {
                    "introduced": "0.12.7"
                },
                {
                    "last_affected": "0.12.7"
                },
                {
                    "introduced": "0.12.8"
                },
                {
                    "last_affected": "0.12.8"
                },
                {
                    "introduced": "0.12.9"
                },
                {
                    "last_affected": "0.12.9"
                },
                {
                    "introduced": "0.12.10"
                },
                {
                    "last_affected": "0.12.10"
                },
                {
                    "introduced": "0.12.11"
                },
                {
                    "last_affected": "0.12.11"
                },
                {
                    "introduced": "0.12.12"
                },
                {
                    "last_affected": "0.12.12"
                },
                {
                    "introduced": "0.12.13"
                },
                {
                    "last_affected": "0.12.13"
                },
                {
                    "introduced": "0.12.14"
                },
                {
                    "last_affected": "0.12.14"
                },
                {
                    "introduced": "0.12.15"
                },
                {
                    "last_affected": "0.12.15"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "last_affected": "4.0.0"
                },
                {
                    "introduced": "4.1.0"
                },
                {
                    "last_affected": "4.1.0"
                },
                {
                    "introduced": "4.1.1"
                },
                {
                    "last_affected": "4.1.1"
                },
                {
                    "introduced": "4.1.2"
                },
                {
                    "last_affected": "4.1.2"
                },
                {
                    "introduced": "4.2.0"
                },
                {
                    "last_affected": "4.2.0"
                },
                {
                    "introduced": "4.2.1"
                },
                {
                    "last_affected": "4.2.1"
                },
                {
                    "introduced": "4.2.2"
                },
                {
                    "last_affected": "4.2.2"
                },
                {
                    "introduced": "4.2.3"
                },
                {
                    "last_affected": "4.2.3"
                },
                {
                    "introduced": "4.2.4"
                },
                {
                    "last_affected": "4.2.4"
                },
                {
                    "introduced": "4.2.5"
                },
                {
                    "last_affected": "4.2.5"
                },
                {
                    "introduced": "4.2.6"
                },
                {
                    "last_affected": "4.2.6"
                },
                {
                    "introduced": "4.3.0"
                },
                {
                    "last_affected": "4.3.0"
                },
                {
                    "introduced": "4.3.1"
                },
                {
                    "last_affected": "4.3.1"
                },
                {
                    "introduced": "4.3.2"
                },
                {
                    "last_affected": "4.3.2"
                },
                {
                    "introduced": "4.4.0"
                },
                {
                    "last_affected": "4.4.0"
                },
                {
                    "introduced": "4.4.1"
                },
                {
                    "last_affected": "4.4.1"
                },
                {
                    "introduced": "4.4.2"
                },
                {
                    "last_affected": "4.4.2"
                },
                {
                    "introduced": "4.4.3"
                },
                {
                    "last_affected": "4.4.3"
                },
                {
                    "introduced": "4.4.4"
                },
                {
                    "last_affected": "4.4.4"
                },
                {
                    "introduced": "4.4.5"
                },
                {
                    "last_affected": "4.4.5"
                },
                {
                    "introduced": "4.4.6"
                },
                {
                    "last_affected": "4.4.6"
                },
                {
                    "introduced": "4.4.7"
                },
                {
                    "last_affected": "4.4.7"
                },
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                }
            ],
            "cpes": [
                "cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.11:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.13:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.14:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.15:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.16-isaacs-manual:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.16:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.17:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.18:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.19:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.20:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.21:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.22:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.23:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.24:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.25:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.26:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.27:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.28:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.29:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.30:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.31:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.32:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.33:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.34:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.35:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.36:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.37:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.38:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.39:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.40:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.41:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.42:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.43:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.44:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.45:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.46:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.10.9:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.11:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.13:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.14:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.15:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:0.12.9:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.1.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.1.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.1.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.2.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.2.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.2.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.2.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.3.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.3.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.3.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.4.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.4.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.4.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.4.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.4.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.4.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.4.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:4.5.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:6.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:6.1.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:6.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:6.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:6.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:6.3.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:6.3.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:6.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:6.5.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:nodejs:node.js:6.6.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "nodejs:node.js"
        },
        {
            "extracted_events": [
                {
                    "introduced": "12.0"
                },
                {
                    "last_affected": "12.0"
                }
            ],
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "suse:linux_enterprise"
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "0.10.x"
                },
                {
                    "fixed": "0.10.47"
                },
                {
                    "introduced": "0.12.x"
                },
                {
                    "fixed": "0.12.16"
                },
                {
                    "introduced": "4.x"
                },
                {
                    "fixed": "4.6.0"
                },
                {
                    "introduced": "6.x"
                },
                {
                    "fixed": "6.7.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
743f0c916469f3129dfae406fa104dc46782e20b
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.6
v0.1.0
v0.1.1
v0.1.10
v0.1.100
v0.1.101
v0.1.102
v0.1.103
v0.1.104
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.2
v0.1.20
v0.1.21
v0.1.22
v0.1.23
v0.1.24
v0.1.25
v0.1.26
v0.1.27
v0.1.28
v0.1.29
v0.1.3
v0.1.30
v0.1.31
v0.1.32
v0.1.33
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.1.92
v0.1.93
v0.1.94
v0.1.95
v0.1.96
v0.1.97
v0.1.98
v0.1.99
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.4.0
v0.5.0
v0.5.1
v0.5.10
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.5-rc1
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.7.0
v0.7.2
v0.7.3
v1.*
v1.0.1
v1.0.1-release
v1.0.2
v1.0.2-release
v1.0.3
v1.0.4
v1.1.0
v1.2.0
v1.3.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.7.0
v1.7.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.5.0
v3.*
v3.0.0
v6.*
v6.0.0
v6.1.0
v6.2.0
v6.2.1
v6.2.2
v6.3.0
v6.3.1
v6.4.0
v6.5.0
v6.6.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-7099.json"