CVE-2016-2086: Input Validation

Q: What is the severity of CVE-2016-2086?

CVE-2016-2086 has a medium severity rating due to its potential to facilitate HTTP request smuggling attacks.

Q: How do I fix CVE-2016-2086?

To fix CVE-2016-2086, upgrade to Node.js versions 0.10.42, 0.12.10, 4.3.0, or 5.6.0 or later.

Q: What types of systems are affected by CVE-2016-2086?

CVE-2016-2086 affects various versions of Node.js prior to the patched versions listed.

Q: Can CVE-2016-2086 be exploited remotely?

Yes, CVE-2016-2086 allows remote attackers to conduct attacks through crafted HTTP headers.

Q: What security measures can be taken against CVE-2016-2086?

Implement input validation for HTTP headers and keep Node.js updated to mitigate CVE-2016-2086.

Published Feb 9, 2016

Updated

Fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086).

HTTP header parsing now aligns more closely with the HTTP spec including restricting the acceptable characters.

Other sources

Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

— MITRE

Affected Software

77 affected componentsFixes available

Nodejs Node.js=0.10.0

Nodejs Node.js=0.10.1

Nodejs Node.js=0.10.2

Nodejs Node.js=0.10.3

Nodejs Node.js=0.10.4

Nodejs Node.js=0.10.5

Nodejs Node.js=0.10.6

Nodejs Node.js=0.10.7

Nodejs Node.js=0.10.8

Nodejs Node.js=0.10.9

Nodejs Node.js=0.10.10

Nodejs Node.js=0.10.11

Nodejs Node.js=0.10.12

Nodejs Node.js=0.10.13

Nodejs Node.js=0.10.14

Nodejs Node.js=0.10.15

Nodejs Node.js=0.10.16

Nodejs Node.js=0.10.16-isaacs-manual

Nodejs Node.js=0.10.17

Nodejs Node.js=0.10.18

Nodejs Node.js=0.10.19

Nodejs Node.js=0.10.20

Nodejs Node.js=0.10.21

Nodejs Node.js=0.10.22

Nodejs Node.js=0.10.23

Nodejs Node.js=0.10.24

Nodejs Node.js=0.10.25

Nodejs Node.js=0.10.26

Nodejs Node.js=0.10.27

Nodejs Node.js=0.10.28

Nodejs Node.js=0.10.29

Nodejs Node.js=0.10.30

Nodejs Node.js=0.10.31

Nodejs Node.js=0.10.32

Nodejs Node.js=0.10.33

Nodejs Node.js=0.10.34

Nodejs Node.js=0.10.35

Nodejs Node.js=0.10.36

Nodejs Node.js=0.10.37

Nodejs Node.js=0.10.38

Nodejs Node.js=0.10.39

Nodejs Node.js=0.10.40

Nodejs Node.js=0.10.41

Nodejs Node.js=0.12.0

Nodejs Node.js=0.12.1

Nodejs Node.js=0.12.2

Nodejs Node.js=0.12.3

Nodejs Node.js=0.12.4

Nodejs Node.js=0.12.5

Nodejs Node.js=0.12.6

Nodejs Node.js=0.12.7

Nodejs Node.js=0.12.8

Nodejs Node.js=0.12.9

Nodejs Node.js=4.0.0

Nodejs Node.js=4.1.0

Nodejs Node.js=4.1.1

Nodejs Node.js=4.1.2

Nodejs Node.js=4.2.0

Nodejs Node.js=4.2.1

Nodejs Node.js=4.2.2

Nodejs Node.js=4.2.3

Nodejs Node.js=4.2.4

Nodejs Node.js=4.2.5

Nodejs Node.js=4.2.6

Nodejs Node.js=5.0.0

Nodejs Node.js=5.1.0

Nodejs Node.js=5.1.1

Nodejs Node.js=5.2.0

Nodejs Node.js=5.3.0

Nodejs Node.js=5.4.0

Nodejs Node.js=5.4.1

Nodejs Node.js=5.5.0

Fedoraproject Fedora=22

Fedoraproject Fedora=23

Node.js Node.js>=4.0.0<4.3.0, >=5.0.0<5.6.0

4.3.05.6.0

Node.js Node.js>=4.0.0<4.3.0

4.3.0

Node.js Node.js>=5.0.0<5.6.0

5.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.3.0Fixed in 5.6.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.3.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.6.0
Upgrade
Upgrade Node.js to a version that resolves this vulnerability.
Fixed in 0.10.42
Upgrade
Upgrade Node.js to a version that resolves this vulnerability.
Fixed in 0.12.10
Upgrade
Upgrade Node.js to a version that resolves this vulnerability.
Fixed in 4.3.0
Upgrade
Upgrade Node.js to a version that resolves this vulnerability.
Fixed in 5.6.0

Event History

Feb 9, 2016

CVE Published

via Node.js·05:32 PM

Data Sourced

via Node.js·05:32 PM

SeverityAffected Software

Apr 7, 2016

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2016-2086?