Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup.

Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of . in the wildcard string.

This is a high severity defect that would allow a malicious TLS server to serve an invalid wildcard certificate for its hostname and be improperly validated by a Node.js client. This is due to a flaw in the validation of . in the wildcard name string.

http: Properly validate for allowable characters in the reason argument in ServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here.

This is a low severity security defect that that may make HTTP response splitting possible under certain circumstances. If user-input is passed to the reason argument to writeHead() on an HTTP response, a new-line character may be used to inject additional responses.

The fix for this defect introduces a new case where throw may occur when configuring HTTP responses. Users should already be adopting try/catch here.

Common Vulnerability Scoring System (CVSS) v3 Base Score:

Metric Score Base Score: 4.8 (Medium) Base Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector: Network (AV:N) Attack Complexity: High (AC:H) Privileges Required: None (PR:N) User Interaction: None (UI:N) Scope of Impact: Unchanged (S:U) Confidentiality Impact: Low (C:L) Integrity Impact: Low (I:L) Availability Impact: None (A:N)

Refer to the CVSS v3 Specification for details on the meanings and application of the vector components.

Fix defects in HTTP header parsing for requests and responses that can allow response splitting (CVE-2016-2216).

HTTP header parsing now aligns more closely with the HTTP spec including restricting the acceptable characters.

Introduce new --security-revert={cvenum} command line flag for selective reversion of specific CVE fixes allow the fix for CVE-2016-2216 to be selectively reverted using --security-revert=CVE-2016-2216.

Fix defects in HTTP header parsing for requests and responses that can allow request smuggling (CVE-2016-2086).

HTTP header parsing now aligns more closely with the HTTP spec including restricting the acceptable characters.

A bug whereby an HTTP socket may no longer have a parser associated with it but a pipelined request attempts to trigger a pause or resume on the non-existent parser, a potential denial-of-service vulnerability.