CVE-2016-2216: Input Validation

Q: What is the severity of CVE-2016-2216?

CVE-2016-2216 is considered a medium severity vulnerability due to its potential to bypass HTTP response-splitting protection mechanisms.

Q: How do I fix CVE-2016-2216?

To fix CVE-2016-2216, upgrade your Node.js version to 0.10.42, 0.12.10, 4.3.0, or 5.6.0 or higher.

Q: What versions of Node.js are affected by CVE-2016-2216?

CVE-2016-2216 affects Node.js versions 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, and earlier versions of 4.x and 5.x.

Q: Can CVE-2016-2216 lead to more serious attacks?

Yes, CVE-2016-2216 could potentially allow attackers to manipulate HTTP headers, leading to further attacks like HTTP response splitting.

Q: Is CVE-2016-2216 specific to certain operating systems?

CVE-2016-2216 primarily affects Node.js applications regardless of the operating system, but its impact may vary based on deployment environments.

Published Feb 9, 2016

Updated

Fix defects in HTTP header parsing for requests and responses that can allow response splitting (CVE-2016-2216).

HTTP header parsing now aligns more closely with the HTTP spec including restricting the acceptable characters.

Introduce new --security-revert={cvenum} command line flag for selective reversion of specific CVE fixes allow the fix for CVE-2016-2216 to be selectively reverted using --security-revert=CVE-2016-2216.

Other sources

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

— MITRE

Affected Software

88 affected componentsFixes available

Nodejs Node.js=0.10.0

Nodejs Node.js=0.10.1

Nodejs Node.js=0.10.2

Nodejs Node.js=0.10.3

Nodejs Node.js=0.10.4

Nodejs Node.js=0.10.5

Nodejs Node.js=0.10.6

Nodejs Node.js=0.10.7

Nodejs Node.js=0.10.8

Nodejs Node.js=0.10.9

Nodejs Node.js=0.10.10

Nodejs Node.js=0.10.11

Nodejs Node.js=0.10.12

Nodejs Node.js=0.10.13

Nodejs Node.js=0.10.14

Nodejs Node.js=0.10.15

Nodejs Node.js=0.10.16

Nodejs Node.js=0.10.16-isaacs-manual

Nodejs Node.js=0.10.17

Nodejs Node.js=0.10.18

Nodejs Node.js=0.10.19

Nodejs Node.js=0.10.20

Nodejs Node.js=0.10.21

Nodejs Node.js=0.10.22

Nodejs Node.js=0.10.23

Nodejs Node.js=0.10.24

Nodejs Node.js=0.10.25

Nodejs Node.js=0.10.26

Nodejs Node.js=0.10.27

Nodejs Node.js=0.10.28

Nodejs Node.js=0.10.29

Nodejs Node.js=0.10.30

Nodejs Node.js=0.10.31

Nodejs Node.js=0.10.32

Nodejs Node.js=0.10.33

Nodejs Node.js=0.10.34

Nodejs Node.js=0.10.35

Nodejs Node.js=0.10.36

Nodejs Node.js=0.10.37

Nodejs Node.js=0.10.38

Nodejs Node.js=0.10.39

Nodejs Node.js=0.10.40

Nodejs Node.js=0.10.41

Nodejs Node.js=0.11.6

Nodejs Node.js=0.11.7

Nodejs Node.js=0.11.8

Nodejs Node.js=0.11.9

Nodejs Node.js=0.11.10

Nodejs Node.js=0.11.11

Nodejs Node.js=0.11.12

Nodejs Node.js=0.11.13

Nodejs Node.js=0.11.14

Nodejs Node.js=0.11.15

Nodejs Node.js=0.11.16

Nodejs Node.js=0.12.0

Nodejs Node.js=0.12.1

Nodejs Node.js=0.12.2

Nodejs Node.js=0.12.3

Nodejs Node.js=0.12.4

Nodejs Node.js=0.12.5

Nodejs Node.js=0.12.6

Nodejs Node.js=0.12.7

Nodejs Node.js=0.12.8

Nodejs Node.js=0.12.9

Nodejs Node.js=4.0.0

Nodejs Node.js=4.1.0

Nodejs Node.js=4.1.1

Nodejs Node.js=4.1.2

Nodejs Node.js=4.2.0

Nodejs Node.js=4.2.1

Nodejs Node.js=4.2.2

Nodejs Node.js=4.2.3

Nodejs Node.js=4.2.4

Nodejs Node.js=4.2.5

Nodejs Node.js=4.2.6

Nodejs Node.js=5.0.0

Nodejs Node.js=5.1.0

Nodejs Node.js=5.1.1

Nodejs Node.js=5.2.0

Nodejs Node.js=5.3.0

Nodejs Node.js=5.4.0

Nodejs Node.js=5.4.1

Nodejs Node.js=5.5.0

Fedoraproject Fedora=22

Fedoraproject Fedora=23

Node.js Node.js>=4.0.0<4.3.0, >=5.0.0<5.6.0

4.3.05.6.0

Node.js Node.js>=4.0.0<4.3.0

4.3.0

Node.js Node.js>=5.0.0<5.6.0

5.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.3.0Fixed in 5.6.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.3.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.6.0
Upgrade
Upgrade Node.js to a version that resolves this vulnerability.
Fixed in 0.10.42Patch CVE-2016-2216
Upgrade
Upgrade Node.js to a version that resolves this vulnerability.
Fixed in 0.12.10Patch CVE-2016-2216
Upgrade
Upgrade Node.js to a version that resolves this vulnerability.
Fixed in 4.3.0Patch CVE-2016-2216
Upgrade
Upgrade Node.js to a version that resolves this vulnerability.
Fixed in 5.6.0Patch CVE-2016-2216

Event History

Feb 9, 2016

CVE Published

via Node.js·05:32 PM

Data Sourced

via Node.js·05:32 PM

SeverityAffected Software

Apr 7, 2016

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2016-2216?