CVE-2016-2086: Input Validation
Published Apr 7, 2016
·Updated
Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
Affected Software
74 affected components
Nodejs Node.js=0.10.0
Nodejs Node.js=0.10.1
Nodejs Node.js=0.10.2
Nodejs Node.js=0.10.3
Nodejs Node.js=0.10.4
Nodejs Node.js=0.10.5
Nodejs Node.js=0.10.6
Nodejs Node.js=0.10.7
Nodejs Node.js=0.10.8
Nodejs Node.js=0.10.9
Nodejs Node.js=0.10.10
Nodejs Node.js=0.10.11
Nodejs Node.js=0.10.12
Nodejs Node.js=0.10.13
Nodejs Node.js=0.10.14
Nodejs Node.js=0.10.15
Nodejs Node.js=0.10.16
Nodejs Node.js=0.10.16-isaacs-manual
Nodejs Node.js=0.10.17
Nodejs Node.js=0.10.18
Nodejs Node.js=0.10.19
Nodejs Node.js=0.10.20
Nodejs Node.js=0.10.21
Nodejs Node.js=0.10.22
Nodejs Node.js=0.10.23
Nodejs Node.js=0.10.24
Nodejs Node.js=0.10.25
Nodejs Node.js=0.10.26
Nodejs Node.js=0.10.27
Nodejs Node.js=0.10.28
Nodejs Node.js=0.10.29
Nodejs Node.js=0.10.30
Nodejs Node.js=0.10.31
Nodejs Node.js=0.10.32
Nodejs Node.js=0.10.33
Nodejs Node.js=0.10.34
Nodejs Node.js=0.10.35
Nodejs Node.js=0.10.36
Nodejs Node.js=0.10.37
Nodejs Node.js=0.10.38
Nodejs Node.js=0.10.39
Nodejs Node.js=0.10.40
Nodejs Node.js=0.10.41
Nodejs Node.js=0.12.0
Nodejs Node.js=0.12.1
Nodejs Node.js=0.12.2
Nodejs Node.js=0.12.3
Nodejs Node.js=0.12.4
Nodejs Node.js=0.12.5
Nodejs Node.js=0.12.6
Nodejs Node.js=0.12.7
Nodejs Node.js=0.12.8
Nodejs Node.js=0.12.9
Nodejs Node.js=4.0.0
Nodejs Node.js=4.1.0
Nodejs Node.js=4.1.1
Nodejs Node.js=4.1.2
Nodejs Node.js=4.2.0
Nodejs Node.js=4.2.1
Nodejs Node.js=4.2.2
Nodejs Node.js=4.2.3
Nodejs Node.js=4.2.4
Nodejs Node.js=4.2.5
Nodejs Node.js=4.2.6
Nodejs Node.js=5.0.0
Nodejs Node.js=5.1.0
Nodejs Node.js=5.1.1
Nodejs Node.js=5.2.0
Nodejs Node.js=5.3.0
Nodejs Node.js=5.4.0
Nodejs Node.js=5.4.1
Nodejs Node.js=5.5.0
Fedoraproject Fedora=22
Fedoraproject Fedora=23
Remediation
Event History
Apr 7, 2016
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2086?
CVE-2016-2086 has a medium severity rating due to its potential to facilitate HTTP request smuggling attacks.
2
How do I fix CVE-2016-2086?
To fix CVE-2016-2086, upgrade to Node.js versions 0.10.42, 0.12.10, 4.3.0, or 5.6.0 or later.
3
What types of systems are affected by CVE-2016-2086?
CVE-2016-2086 affects various versions of Node.js prior to the patched versions listed.
4
Can CVE-2016-2086 be exploited remotely?
Yes, CVE-2016-2086 allows remote attackers to conduct attacks through crafted HTTP headers.
5
What security measures can be taken against CVE-2016-2086?
Implement input validation for HTTP headers and keep Node.js updated to mitigate CVE-2016-2086.