Medium severity · published Oct 10, 2016
CVE-2016-7099
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name…
5.9
CVSS
2.8%
EPSS
No
On KEV
Description
The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Linux Enterprise · Suse
12.0 · source: NVD
NO
Node.js · Nodejs
0.10.0; 0.10.1; 0.10.2; 0.10.3; 0.10.4; 0.10.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-7099
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-7099
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2017-0002.html
Third Party Advisory
http://www.securityfocus.com/bid/93191
Issue Tracking
https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20b
Patch
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
More from Node.js
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
9.8
CVE-2024-3566
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific…
9.8
CVE-2024-21896
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user