Fix defects in HTTP header parsing for requests and responses that can allow response splitting (CVE-2016-2216).

HTTP header parsing now aligns more closely with the HTTP spec including restricting the acceptable characters.

Introduce new --security-revert={cvenum} command line flag for selective reversion of specific CVE fixes allow the fix for CVE-2016-2216 to be selectively reverted using --security-revert=CVE-2016-2216.

Fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086).

HTTP header parsing now aligns more closely with the HTTP spec including restricting the acceptable characters.

http: Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here.

This is a low severity security defect that that may make HTTP response splitting possible under certain circumstances. If user-input is passed to the reason argument to writeHead() on an HTTP response, a new-line character may be used to inject additional responses.

The fix for this defect introduces a new case where throw may occur when configuring HTTP responses. Users should already be adopting try/catch here.

Common Vulnerability Scoring System (CVSS) v3 Base Score:

Metric Score Base Score: 4.8 (Medium) Base Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector: Network (AV:N) Attack Complexity: High (AC:H) Privileges Required: None (PR:N) User Interaction: None (UI:N) Scope of Impact: Unchanged (S:U) Confidentiality Impact: Low (C:L) Integrity Impact: Low (I:L) Availability Impact: None (A:N)

Refer to the CVSS v3 Specification for details on the meanings and application of the vector components.

Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of . in the wildcard string.

This is a high severity defect that would allow a malicious TLS server to serve an invalid wildcard certificate for its hostname and be improperly validated by a Node.js client. This is due to a flaw in the validation of . in the wildcard name string.