VDB
DEBIAN-CVE-2016-2216
DEBIAN-CVE-2016-2216
PUBLISHED
CVSS 7.5 HIGH
The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.
Risk Scores
CVSS v3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | nodejs | 0, 0, 0 |
| Debian:14 | nodejs | 0, 0, 0 |
| Debian:11 | nodejs | 0, 0, 0 |
| Debian:13 | nodejs | 0, 0, 0 |
Timeline
- Apr 7, 2016 CVE Published
- Apr 28, 2026 CVE Updated