CVE-2016-5325: HTTP processing security defect (CVE-2016-5325)

Published Jun 13, 2016
·
Updated

http: Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here.

This is a low severity security defect that that may make HTTP response splitting possible under certain circumstances. If user-input is passed to the reason argument to writeHead() on an HTTP response, a new-line character may be used to inject additional responses.

The fix for this defect introduces a new case where throw may occur when configuring HTTP responses. Users should already be adopting try/catch here.

Common Vulnerability Scoring System (CVSS) v3 Base Score:

Metric Score Base Score: 4.8 (Medium) Base Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector: Network (AV:N) Attack Complexity: High (AC:H) Privileges Required: None (PR:N) User Interaction: None (UI:N) Scope of Impact: Unchanged (S:U) Confidentiality Impact: Low (C:L) Integrity Impact: Low (I:L) Availability Impact: None (A:N)

Refer to the CVSS v3 Specification for details on the meanings and application of the vector components.

Other sources

An unspecified low-severity Node.js HTTP processing vulnerability was found and will be fixed in latest update. Details are currently embargoed until new releases are available.

https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/

— Red Hat

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

— MITRE

We will be including fixes relating to Node.js HTTP processing. We categorise these as low-severity and are not aware of any existing exploits leveraging the defects. Full details are embargoed until new releases are available.

Common Vulnerability Scoring System (CVSS) v3 Base Score:

Refer to the CVSS v3 Specification for details on the meanings and application of the vector components.

All versions of Node.js are affected.

This defect will identified as CVE-2016-5325

— Node.Js

Affected Software

105 affected componentsFixes available
redhat/nodejs<6.7.0
6.7.0
redhat/nodejs<4.6.0
4.6.0
redhat/nodejs<0.12.16
0.12.16
redhat/nodejs<0.10.47
0.10.47
Nodejs Node.js=4.0.0
Nodejs Node.js=4.1.0
Nodejs Node.js=4.1.1
Nodejs Node.js=4.1.2
Nodejs Node.js=4.2.0
Nodejs Node.js=4.2.1
Nodejs Node.js=4.2.2
Nodejs Node.js=4.2.3
Nodejs Node.js=4.2.4
Nodejs Node.js=4.2.5
Nodejs Node.js=4.2.6
Nodejs Node.js=4.3.0
Nodejs Node.js=4.3.1
Nodejs Node.js=4.3.2
Nodejs Node.js=4.4.0
Nodejs Node.js=4.4.1
Nodejs Node.js=4.4.2
Nodejs Node.js=4.4.3
Nodejs Node.js=4.4.4
Nodejs Node.js=4.4.5
Nodejs Node.js=4.4.6
Nodejs Node.js=4.4.7
Nodejs Node.js=4.5.0
Nodejs Node.js=0.10.0
Nodejs Node.js=0.10.1
Nodejs Node.js=0.10.2
Nodejs Node.js=0.10.3
Nodejs Node.js=0.10.4
Nodejs Node.js=0.10.5
Nodejs Node.js=0.10.6
Nodejs Node.js=0.10.7
Nodejs Node.js=0.10.8
Nodejs Node.js=0.10.9
Nodejs Node.js=0.10.10
Nodejs Node.js=0.10.11
Nodejs Node.js=0.10.12
Nodejs Node.js=0.10.13
Nodejs Node.js=0.10.14
Nodejs Node.js=0.10.15
Nodejs Node.js=0.10.16
Nodejs Node.js=0.10.16-isaacs-manual
Nodejs Node.js=0.10.17
Nodejs Node.js=0.10.18
Nodejs Node.js=0.10.19
Nodejs Node.js=0.10.20
Nodejs Node.js=0.10.21
Nodejs Node.js=0.10.22
Nodejs Node.js=0.10.23
Nodejs Node.js=0.10.24
Nodejs Node.js=0.10.25
Nodejs Node.js=0.10.26
Nodejs Node.js=0.10.27
Nodejs Node.js=0.10.28
Nodejs Node.js=0.10.29
Nodejs Node.js=0.10.30
Nodejs Node.js=0.10.31
Nodejs Node.js=0.10.32
Nodejs Node.js=0.10.33
Nodejs Node.js=0.10.34
Nodejs Node.js=0.10.35
Nodejs Node.js=0.10.36
Nodejs Node.js=0.10.37
Nodejs Node.js=0.10.38
Nodejs Node.js=0.10.39
Nodejs Node.js=0.10.40
Nodejs Node.js=0.10.41
Nodejs Node.js=0.10.42
Nodejs Node.js=0.10.43
Nodejs Node.js=0.10.44
Nodejs Node.js=0.10.45
Nodejs Node.js=0.10.46
SUSE Linux Enterprise=12.0
Nodejs Node.js=0.12.0
Nodejs Node.js=0.12.1
Nodejs Node.js=0.12.2
Nodejs Node.js=0.12.3
Nodejs Node.js=0.12.4
Nodejs Node.js=0.12.5
Nodejs Node.js=0.12.6
Nodejs Node.js=0.12.7
Nodejs Node.js=0.12.8
Nodejs Node.js=0.12.9
Nodejs Node.js=0.12.10
Nodejs Node.js=0.12.11
Nodejs Node.js=0.12.12
Nodejs Node.js=0.12.13
Nodejs Node.js=0.12.14
Nodejs Node.js=0.12.15
Nodejs Node.js=6.0.0
Nodejs Node.js=6.1.0
Nodejs Node.js=6.2.0
Nodejs Node.js=6.2.1
Nodejs Node.js=6.2.2
Nodejs Node.js=6.3.0
Nodejs Node.js=6.3.1
Nodejs Node.js=6.4.0
Nodejs Node.js=6.5.0
Nodejs Node.js=6.6.0
Node.js Node.js>=4.0.0<4.6.0, >=5.0.0<6.0.0, >=6.0.0<6.7.0
4.6.06.7.0
Node.js Node.js>=4.0.0<4.6.0
4.6.0
Node.js Node.js>=6.0.0<6.7.0
6.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/nodejs to a version that resolves this vulnerability.

    Fixed in 6.7.0
  2. Upgrade

    Upgrade redhat/nodejs to a version that resolves this vulnerability.

    Fixed in 4.6.0
  3. Upgrade

    Upgrade redhat/nodejs to a version that resolves this vulnerability.

    Fixed in 0.12.16
  4. Upgrade

    Upgrade redhat/nodejs to a version that resolves this vulnerability.

    Fixed in 0.10.47
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 4.6.0Fixed in 6.7.0
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 4.6.0
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.7.0
  8. Upgrade

    Upgrade Node.js to a version that resolves this vulnerability.

    Fixed in 0.10.47
  9. Upgrade

    Upgrade Node.js to a version that resolves this vulnerability.

    Fixed in 0.12.16
  10. Upgrade

    Upgrade Node.js to a version that resolves this vulnerability.

    Fixed in 4.6.0
  11. Upgrade

    Upgrade Node.js to a version that resolves this vulnerability.

    Fixed in 6.7.0
  12. Compensating control

    Validate the reason argument passed to ServerResponse#writeHead() for allowable characters, particularly when it contains user input, to prevent newline characters from injecting HTTP headers or additional responses.

Event History

Jun 13, 2016
CVE Published
via Node.js·12:57 PM
Data Sourced
via Node.js·12:57 PM
DescriptionSeverity
Sep 28, 2016
Data Sourced
via Node.js·12:47 AM
Affected Software
Oct 10, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2016-5325?

CVE-2016-5325 is considered to have a moderate severity level due to the potential for HTTP response splitting attacks.

2

How do I fix CVE-2016-5325?

To fix CVE-2016-5325, upgrade Node.js to versions 0.10.47, 0.12.16, 4.6.0, or 6.7.0 or later.

3

What impact can CVE-2016-5325 have on my application?

CVE-2016-5325 allows attackers to inject arbitrary HTTP headers, potentially leading to cache poisoning and other related attacks.

4

Which Node.js versions are affected by CVE-2016-5325?

CVE-2016-5325 affects Node.js versions prior to 0.10.47, 0.12.16, 4.6.0, and 6.7.0.

5

Can I mitigate CVE-2016-5325 without upgrading Node.js?

Mitigating CVE-2016-5325 without upgrading Node.js is challenging; it's best to upgrade to the fixed versions.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203