CVE-2016-5325

high-risk

Published 2016-10-10

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

Do I need to act?

0.98% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Node.Js

Affected Vendors

Suse Nodejs

References (14)

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

http://rhn.redhat.com/errata/RHSA-2017-0002.html

http://www.securityfocus.com/bid/93483

https://access.redhat.com/errata/RHSA-2016:2101

Issue Tracking https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762

Patch https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

https://security.gentoo.org/glsa/201612-43

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

http://rhn.redhat.com/errata/RHSA-2017-0002.html

http://www.securityfocus.com/bid/93483

https://access.redhat.com/errata/RHSA-2016:2101

Issue Tracking https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762

Patch https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

https://security.gentoo.org/glsa/201612-43

/ 100

high-risk

Severity 23/34 · High

Exploitability 3/34 · Minimal

Exposure 30/34 · Critical