CVE-2016-2216: Input Validation

Published Apr 7, 2016

Updated

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

Affected Software

85 affected components

Nodejs Node.js=0.10.0

Nodejs Node.js=0.10.1

Nodejs Node.js=0.10.2

Nodejs Node.js=0.10.3

Nodejs Node.js=0.10.4

Nodejs Node.js=0.10.5

Nodejs Node.js=0.10.6

Nodejs Node.js=0.10.7

Nodejs Node.js=0.10.8

Nodejs Node.js=0.10.9

Nodejs Node.js=0.10.10

Nodejs Node.js=0.10.11

Nodejs Node.js=0.10.12

Nodejs Node.js=0.10.13

Nodejs Node.js=0.10.14

Nodejs Node.js=0.10.15

Nodejs Node.js=0.10.16

Nodejs Node.js=0.10.16-isaacs-manual

Nodejs Node.js=0.10.17

Nodejs Node.js=0.10.18

Nodejs Node.js=0.10.19

Nodejs Node.js=0.10.20

Nodejs Node.js=0.10.21

Nodejs Node.js=0.10.22

Nodejs Node.js=0.10.23

Nodejs Node.js=0.10.24

Nodejs Node.js=0.10.25

Nodejs Node.js=0.10.26

Nodejs Node.js=0.10.27

Nodejs Node.js=0.10.28

Nodejs Node.js=0.10.29

Nodejs Node.js=0.10.30

Nodejs Node.js=0.10.31

Nodejs Node.js=0.10.32

Nodejs Node.js=0.10.33

Nodejs Node.js=0.10.34

Nodejs Node.js=0.10.35

Nodejs Node.js=0.10.36

Nodejs Node.js=0.10.37

Nodejs Node.js=0.10.38

Nodejs Node.js=0.10.39

Nodejs Node.js=0.10.40

Nodejs Node.js=0.10.41

Nodejs Node.js=0.11.6

Nodejs Node.js=0.11.7

Nodejs Node.js=0.11.8

Nodejs Node.js=0.11.9

Nodejs Node.js=0.11.10

Nodejs Node.js=0.11.11

Nodejs Node.js=0.11.12

Nodejs Node.js=0.11.13

Nodejs Node.js=0.11.14

Nodejs Node.js=0.11.15

Nodejs Node.js=0.11.16

Nodejs Node.js=0.12.0

Nodejs Node.js=0.12.1

Nodejs Node.js=0.12.2

Nodejs Node.js=0.12.3

Nodejs Node.js=0.12.4

Nodejs Node.js=0.12.5

Nodejs Node.js=0.12.6

Nodejs Node.js=0.12.7

Nodejs Node.js=0.12.8

Nodejs Node.js=0.12.9

Nodejs Node.js=4.0.0

Nodejs Node.js=4.1.0

Nodejs Node.js=4.1.1

Nodejs Node.js=4.1.2

Nodejs Node.js=4.2.0

Nodejs Node.js=4.2.1

Nodejs Node.js=4.2.2

Nodejs Node.js=4.2.3

Nodejs Node.js=4.2.4

Nodejs Node.js=4.2.5

Nodejs Node.js=4.2.6

Nodejs Node.js=5.0.0

Nodejs Node.js=5.1.0

Nodejs Node.js=5.1.1

Nodejs Node.js=5.2.0

Nodejs Node.js=5.3.0

Nodejs Node.js=5.4.0

Nodejs Node.js=5.4.1

Nodejs Node.js=5.5.0

Fedoraproject Fedora=22

Fedoraproject Fedora=23

Remediation

Patch Available

https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/

Event History

Apr 7, 2016

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-2216?

CVE-2016-2216 is considered a medium severity vulnerability due to its potential to bypass HTTP response-splitting protection mechanisms.

How do I fix CVE-2016-2216?

To fix CVE-2016-2216, upgrade your Node.js version to 0.10.42, 0.12.10, 4.3.0, or 5.6.0 or higher.

What versions of Node.js are affected by CVE-2016-2216?

CVE-2016-2216 affects Node.js versions 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, and earlier versions of 4.x and 5.x.

Can CVE-2016-2216 lead to more serious attacks?

Yes, CVE-2016-2216 could potentially allow attackers to manipulate HTTP headers, leading to further attacks like HTTP response splitting.

Is CVE-2016-2216 specific to certain operating systems?

CVE-2016-2216 primarily affects Node.js applications regardless of the operating system, but its impact may vary based on deployment environments.