Medium severity · published Oct 10, 2016
CVE-2016-5325
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote…
6.1
CVSS
4.1%
EPSS
No
On KEV
Description
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Linux Enterprise · Suse
12.0 · source: NVD
NO
Node.js · Nodejs
4.0.0; 4.1.0; 4.1.1; 4.1.2; 4.2.0; 4.2.1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-5325
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-5325
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2017-0002.html
www.securityfocus.com
http://www.securityfocus.com/bid/93483
access.redhat.com
https://access.redhat.com/errata/RHSA-2016:2101
Issue Tracking
https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762
Patch
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
More from Node.js
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
9.8
CVE-2024-3566
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific…
9.8
CVE-2024-21896
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user