high7.5
CVE-2016-2086
Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks v…
Impact
Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodejs | Node.Js | Versions 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5 |
| Fedoraproject | Fedora | Versions 22, 23 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html
- http://www.securityfocus.com/bid/83282
- https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/
- https://security.gentoo.org/glsa/201612-43
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html
- http://www.securityfocus.com/bid/83282
- https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/
- https://security.gentoo.org/glsa/201612-43