Fluid Attacks Database

Description

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	nodejs	>=0 <4.3.0~dfsg-1	4.3.0~dfsg-1
debian 12	nodejs	>=0 <4.3.0~dfsg-1	4.3.0~dfsg-1
debian 11	nodejs	>=0 <4.3.0~dfsg-1	4.3.0~dfsg-1
debian 13	nodejs	>=0 <4.3.0~dfsg-1	4.3.0~dfsg-1
npm	node	>=0.10.0 <=0.10.0 \|\| >=0.10.1 <=0.10.1 \|\| >=0.10.2 <=0.10.2 \|\| >=0.10.3 <=0.10.3 \|\| >=0.10.4 <=0.10.4 \|\| >=0.10.5 <=0.10.5 \|\| >=0.10.6 <=0.10.6 \|\| >=0.10.7 <=0.10.7 \|\| >=0.10.8 <=0.10.8 \|\| >=0.10.9 <=0.10.9 \|\| >=0.10.10 <=0.10.10 \|\| >=0.10.11 <=0.10.11 \|\| >=0.10.12 <=0.10.12 \|\| >=0.10.13 <=0.10.13 \|\| >=0.10.14 <=0.10.14 \|\| >=0.10.15 <=0.10.15 \|\| >=0.10.16 <=0.10.16 \|\| >=0.10.16-isaacs-manual <=0.10.16-isaacs-manual \|\| >=0.10.17 <=0.10.17 \|\| >=0.10.18 <=0.10.18 \|\| >=0.10.19 <=0.10.19 \|\| >=0.10.20 <=0.10.20 \|\| >=0.10.21 <=0.10.21 \|\| >=0.10.22 <=0.10.22 \|\| >=0.10.23 <=0.10.23 \|\| >=0.10.24 <=0.10.24 \|\| >=0.10.25 <=0.10.25 \|\| >=0.10.26 <=0.10.26 \|\| >=0.10.27 <=0.10.27 \|\| >=0.10.28 <=0.10.28 \|\| >=0.10.29 <=0.10.29 \|\| >=0.10.30 <=0.10.30 \|\| >=0.10.31 <=0.10.31 \|\| >=0.10.32 <=0.10.32 \|\| >=0.10.33 <=0.10.33 \|\| >=0.10.34 <=0.10.34 \|\| >=0.10.35 <=0.10.35 \|\| >=0.10.36 <=0.10.36 \|\| >=0.10.37 <=0.10.37 \|\| >=0.10.38 <=0.10.38 \|\| >=0.10.39 <=0.10.39 \|\| >=0.10.40 <=0.10.40 \|\| >=0.10.41 <=0.10.41 \|\| >=0.11.6 <=0.11.6 \|\| >=0.11.7 <=0.11.7 \|\| >=0.11.8 <=0.11.8 \|\| >=0.11.9 <=0.11.9 \|\| >=0.11.10 <=0.11.10 \|\| >=0.11.11 <=0.11.11 \|\| >=0.11.12 <=0.11.12 \|\| >=0.11.13 <=0.11.13 \|\| >=0.11.14 <=0.11.14 \|\| >=0.11.15 <=0.11.15 \|\| >=0.11.16 <=0.11.16 \|\| >=0.12.0 <=0.12.0 \|\| >=0.12.1 <=0.12.1 \|\| >=0.12.2 <=0.12.2 \|\| >=0.12.3 <=0.12.3 \|\| >=0.12.4 <=0.12.4 \|\| >=0.12.5 <=0.12.5 \|\| >=0.12.6 <=0.12.6 \|\| >=0.12.7 <=0.12.7 \|\| >=0.12.8 <=0.12.8 \|\| >=0.12.9 <=0.12.9 \|\| >=4.0.0 <=4.0.0 \|\| >=4.1.0 <=4.1.0 \|\| >=4.1.1 <=4.1.1 \|\| >=4.1.2 <=4.1.2 \|\| >=4.2.0 <=4.2.0 \|\| >=4.2.1 <=4.2.1 \|\| >=4.2.2 <=4.2.2 \|\| >=4.2.3 <=4.2.3 \|\| >=4.2.4 <=4.2.4 \|\| >=4.2.5 <=4.2.5 \|\| >=4.2.6 <=4.2.6 \|\| >=5.0.0 <=5.0.0 \|\| >=5.1.0 <=5.1.0 \|\| >=5.1.1 <=5.1.1 \|\| >=5.2.0 <=5.2.0 \|\| >=5.3.0 <=5.3.0 \|\| >=5.4.0 <=5.4.0 \|\| >=5.4.1 <=5.4.1 \|\| >=5.5.0 <=5.5.0	0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.10.7, 0.10.8, 0.10.9, 0.10.10, 0.10.11, 0.10.12, 0.10.13, 0.10.14, 0.10.15, 0.10.16, 0.10.17, 0.10.18, 0.10.19, 0.10.20, 0.10.21, 0.10.22, 0.10.23, 0.10.24, 0.10.25, 0.10.26, 0.10.27, 0.10.28, 0.10.29, 0.10.30, 0.10.31, 0.10.32, 0.10.33, 0.10.34, 0.10.35, 0.10.36, 0.10.37, 0.10.38, 0.10.39, 0.10.40, 0.10.41, 0.10.42, 0.11.7, 0.11.8, 0.11.9, 0.11.10, 0.11.11, 0.11.12, 0.11.13, 0.11.14, 0.11.15, 0.11.16, 0.12.0, 0.12.1, 0.12.2, 0.12.3, 0.12.4, 0.12.5, 0.12.6, 0.12.7, 0.12.8, 0.12.9, 0.12.10, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.3.0, 5.1.0, 5.1.1, 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.5.0, 5.6.0

Aliases

1. CVE-2016-22162. NVD-2016-22163. OSV-DEBIAN-2016-22164. OSV-2016-22165. GCVE-2016-22166. SECURITY-TRACKER-CVE-2016-22167. security.gentoo.org

References

1. http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf2. http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html3. http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html4. http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html5. http://www.securityfocus.com/bid/831416. https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/7. http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.