CVE-2016-2216 — Vulnetix

Try Vulnetix Request Demo

CVE-2016-2216 PUBLISHED

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

EPSS 1.83% · 82.8th percentile

Risk Scores

EPSS Score

1.83%

82.8th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:16.04:LTS	nodejs	4.2.6~dfsg-1ubuntu4.2+esm3, 0, 0.10.25~dfsg2-2ubuntu1
Ubuntu:Pro:14.04:LTS	nodejs	0, 0.10.15~dfsg1-4, 0.10.21~dfsg1-1

Timeline

CVE Published
Nov 12, 2019 PoC Published
Feb 4, 2022 EPSS Score
Mar 28, 2022 EPSS Score
May 19, 2022 EPSS Score
Sep 1, 2022 EPSS Score
Oct 23, 2022 EPSS Score
Dec 14, 2022 EPSS Score
Feb 4, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 28, 2023 EPSS Score
Jul 10, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2016-2216 third-party-advisory
https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/ third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2016-2216 third-party-advisory

Open in Interactive Console →