Detections
Analytics
CVE-2016-2216
high
Description
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
References
https://security.gentoo.org/glsa/201612-43
https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/
https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-3300
http://www.securityfocus.com/bid/83141
http://packetstormsecurity.com/files/135711/Node.js-HTTP-Response-Splitting.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html
http://info.safebreach.com/hubfs/Node-js-Response-Splitting.pdf
http://blog.safebreach.com/2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/