Fluid Attacks Database

Description

Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	nodejs	>=0 <4.3.0~dfsg-1	4.3.0~dfsg-1
debian 11	nodejs	>=0 <4.3.0~dfsg-1	4.3.0~dfsg-1
debian 13	nodejs	>=0 <4.3.0~dfsg-1	4.3.0~dfsg-1
debian 12	nodejs	>=0 <4.3.0~dfsg-1	4.3.0~dfsg-1
npm	node	>=0.10.0 <=0.10.0 \|\| >=0.10.1 <=0.10.1 \|\| >=0.10.2 <=0.10.2 \|\| >=0.10.3 <=0.10.3 \|\| >=0.10.4 <=0.10.4 \|\| >=0.10.5 <=0.10.5 \|\| >=0.10.6 <=0.10.6 \|\| >=0.10.7 <=0.10.7 \|\| >=0.10.8 <=0.10.8 \|\| >=0.10.9 <=0.10.9 \|\| >=0.10.10 <=0.10.10 \|\| >=0.10.11 <=0.10.11 \|\| >=0.10.12 <=0.10.12 \|\| >=0.10.13 <=0.10.13 \|\| >=0.10.14 <=0.10.14 \|\| >=0.10.15 <=0.10.15 \|\| >=0.10.16 <=0.10.16 \|\| >=0.10.16-isaacs-manual <=0.10.16-isaacs-manual \|\| >=0.10.17 <=0.10.17 \|\| >=0.10.18 <=0.10.18 \|\| >=0.10.19 <=0.10.19 \|\| >=0.10.20 <=0.10.20 \|\| >=0.10.21 <=0.10.21 \|\| >=0.10.22 <=0.10.22 \|\| >=0.10.23 <=0.10.23 \|\| >=0.10.24 <=0.10.24 \|\| >=0.10.25 <=0.10.25 \|\| >=0.10.26 <=0.10.26 \|\| >=0.10.27 <=0.10.27 \|\| >=0.10.28 <=0.10.28 \|\| >=0.10.29 <=0.10.29 \|\| >=0.10.30 <=0.10.30 \|\| >=0.10.31 <=0.10.31 \|\| >=0.10.32 <=0.10.32 \|\| >=0.10.33 <=0.10.33 \|\| >=0.10.34 <=0.10.34 \|\| >=0.10.35 <=0.10.35 \|\| >=0.10.36 <=0.10.36 \|\| >=0.10.37 <=0.10.37 \|\| >=0.10.38 <=0.10.38 \|\| >=0.10.39 <=0.10.39 \|\| >=0.10.40 <=0.10.40 \|\| >=0.10.41 <=0.10.41 \|\| >=0.12.0 <=0.12.0 \|\| >=0.12.1 <=0.12.1 \|\| >=0.12.2 <=0.12.2 \|\| >=0.12.3 <=0.12.3 \|\| >=0.12.4 <=0.12.4 \|\| >=0.12.5 <=0.12.5 \|\| >=0.12.6 <=0.12.6 \|\| >=0.12.7 <=0.12.7 \|\| >=0.12.8 <=0.12.8 \|\| >=0.12.9 <=0.12.9 \|\| >=4.0.0 <=4.0.0 \|\| >=4.1.0 <=4.1.0 \|\| >=4.1.1 <=4.1.1 \|\| >=4.1.2 <=4.1.2 \|\| >=4.2.0 <=4.2.0 \|\| >=4.2.1 <=4.2.1 \|\| >=4.2.2 <=4.2.2 \|\| >=4.2.3 <=4.2.3 \|\| >=4.2.4 <=4.2.4 \|\| >=4.2.5 <=4.2.5 \|\| >=4.2.6 <=4.2.6 \|\| >=5.0.0 <=5.0.0 \|\| >=5.1.0 <=5.1.0 \|\| >=5.1.1 <=5.1.1 \|\| >=5.2.0 <=5.2.0 \|\| >=5.3.0 <=5.3.0 \|\| >=5.4.0 <=5.4.0 \|\| >=5.4.1 <=5.4.1 \|\| >=5.5.0 <=5.5.0	0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.10.7, 0.10.8, 0.10.9, 0.10.10, 0.10.11, 0.10.12, 0.10.13, 0.10.14, 0.10.15, 0.10.16, 0.10.17, 0.10.18, 0.10.19, 0.10.20, 0.10.21, 0.10.22, 0.10.23, 0.10.24, 0.10.25, 0.10.26, 0.10.27, 0.10.28, 0.10.29, 0.10.30, 0.10.31, 0.10.32, 0.10.33, 0.10.34, 0.10.35, 0.10.36, 0.10.37, 0.10.38, 0.10.39, 0.10.40, 0.10.41, 0.10.42, 0.12.1, 0.12.2, 0.12.3, 0.12.4, 0.12.5, 0.12.6, 0.12.7, 0.12.8, 0.12.9, 0.12.10, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.3.0, 5.1.0, 5.1.1, 5.2.0, 5.3.0, 5.4.0, 5.4.1, 5.5.0, 5.6.0

Aliases

1. CVE-2016-20862. NVD-2016-20863. OSV-DEBIAN-2016-20864. OSV-2016-20865. GCVE-2016-20866. SECURITY-TRACKER-CVE-2016-20867. security.gentoo.org

References

1. http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html2. http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html3. http://www.securityfocus.com/bid/832824. https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.