Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote     attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
    (CVE-2016-2086)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201612-43 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition, or       conduct man-in-the-middle attacks.
  Workaround :

    There is no known workaround at this time.

The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 8.1. It is, therefore, affected by multiple remote code execution vulnerabilities in the Node.js component of the Xcode Server. An unauthenticated, remote attacker can exploit these vulnerabilities to cause a denial of service condition or the execution of arbitrary code.

Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
(CVE-2016-2086)

Security fix for CVE-2016-2216, CVE-2016-2086

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs fixes the following issues :

  - CVE-2016-2216: Response splitting vulnerability using     Unicode characters (boo#966076)

  - CVE-2016-2086: Request smuggling vulnerability     (boo#966077)

Node.js was updated to the 4.3.1 LTS version, containing all upstream bug fixes and improvements.

ID	Name	Product	Family	Severity
254998	Linux Distros Unpatched Vulnerability : CVE-2016-2086	Nessus	Misc.	high
95817	GLSA-201612-43 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
94935	Apple Xcode < 8.1 Node.js Multiple RCE (macOS)	Nessus	MacOS X Local Security Checks	critical
93696	F5 Networks BIG-IP : NodeJS vulnerability (K15311661)	Nessus	F5 Networks Local Security Checks	high
89575	Fedora 22 : nodejs-0.10.42-4.fc22 (2016-8925b6119f)	Nessus	Fedora Local Security Checks	high
89508	Fedora 23 : nodejs-0.10.42-4.fc23 (2016-3102c11757)	Nessus	Fedora Local Security Checks	high
89019	openSUSE Security Update : nodejs (openSUSE-2016-283)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-2086

high

Tenable Plugins

high

high

critical

high

high

high

high