Login Request a demo
Unscored severity · published Aug 13, 2012
CVE-2012-2330
The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain…
–
CVSS
2.6%
EPSS
No
On KEV
Description
The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Nodejs · Nodejs
through 0.6.16; 0.7.0; 0.7.1; 0.7.2; 0.7.3; 0.7.4; +3 more · source: NVD
Affected product
NO
Nodejs
Nodejs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2330
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2330
blog.nodejs.org
http://blog.nodejs.org/2012/05/04/version-0-6-17-stable/
Vendor Advisory
http://secunia.com/advisories/49066
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/05/08/4
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/05/08/8
Exploit
https://github.com/joyent/node/commit/7b3fb22
Exploit
https://github.com/joyent/node/commit/c9a231d
More from Nodejs
8.1
CVE-2024-36138
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn /…
7.7
CVE-2023-30584
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model
7.5
CVE-2023-30587
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector)
7.5
CVE-2023-30583
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20
7.4
CVE-2023-46809
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack -…