Fluid Attacks Database

Description

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	nodejs	>=0 <10.15.0~dfsg-6	10.15.0~dfsg-6
debian 14	nodejs	>=0 <10.15.0~dfsg-6	10.15.0~dfsg-6
debian 13	nodejs	>=0 <10.15.0~dfsg-6	10.15.0~dfsg-6
alpine v3.8	nodejs	>=0 <8.14.0-r0	8.14.0-r0
npm	node	>=6.0.0 <=6.8.1 \|\| >=6.9.0 <6.15.0 \|\| >=8.0.0 <=8.8.1 \|\| >=8.9.0 <8.14.0	6.15.0, 8.14.0

Aliases

1. CVE-2018-121162. NVD-2018-121163. OSV-DEBIAN-2018-121164. OSV-2018-121165. OSV-ALPINE-2018-121166. GCVE-2018-121167. SECURITY-TRACKER-CVE-2018-121168. SECURITY-CVE-2018-121169. access.redhat.com10. security.gentoo.org

References

1. https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.