CVE-2016-5325: CRLF Injection
An unspecified low-severity Node.js HTTP processing vulnerability was found and will be fixed in latest update. Details are currently embargoed until new releases are available.
https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/
Other sources
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5325?
CVE-2016-5325 is considered to have a moderate severity level due to the potential for HTTP response splitting attacks.
How do I fix CVE-2016-5325?
To fix CVE-2016-5325, upgrade Node.js to versions 0.10.47, 0.12.16, 4.6.0, or 6.7.0 or later.
What impact can CVE-2016-5325 have on my application?
CVE-2016-5325 allows attackers to inject arbitrary HTTP headers, potentially leading to cache poisoning and other related attacks.
Which Node.js versions are affected by CVE-2016-5325?
CVE-2016-5325 affects Node.js versions prior to 0.10.47, 0.12.16, 4.6.0, and 6.7.0.
Can I mitigate CVE-2016-5325 without upgrading Node.js?
Mitigating CVE-2016-5325 without upgrading Node.js is challenging; it's best to upgrade to the fixed versions.