CVE-2016-5325

MEDIUM

Node.js <6.7.0 - CRLF Injection

Title source: llm

Description

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

References (7)

[Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

[Vendor Advisory] http://rhn.redhat.com/errata/RHSA-2017-0002.html

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2016:2101

[Issue Tracking, Patch] https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762

[Patch, Vendor Advisory] https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/93483

[Third Party Advisory] https://security.gentoo.org/glsa/201612-43

Scores

CVSS v3 6.1

EPSS 0.0098

EPSS Percentile 76.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-113

Status draft

Affected Products (50)

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

nodejs/node.js

... and 35 more

Timeline

Published Oct 10, 2016

Tracked Since Feb 18, 2026