CVE-2016-5325 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2016-5325

Modified

More Info Official Page

Source-cve@mitre.org

Published At-10 Oct, 2016 | 16:59

Updated At-06 May, 2026 | 22:30

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.0

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

Node.js (OpenJS Foundation)

>>node.js>>4.0.0

cpe:2.3:a:nodejs:node.js:4.0.0:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.1.0

cpe:2.3:a:nodejs:node.js:4.1.0:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.1.1

cpe:2.3:a:nodejs:node.js:4.1.1:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.1.2

cpe:2.3:a:nodejs:node.js:4.1.2:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.2.0

cpe:2.3:a:nodejs:node.js:4.2.0:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.2.1

cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.2.2

cpe:2.3:a:nodejs:node.js:4.2.2:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.2.3

cpe:2.3:a:nodejs:node.js:4.2.3:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.2.4

cpe:2.3:a:nodejs:node.js:4.2.4:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.2.5

cpe:2.3:a:nodejs:node.js:4.2.5:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.2.6

cpe:2.3:a:nodejs:node.js:4.2.6:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.3.0

cpe:2.3:a:nodejs:node.js:4.3.0:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.3.1

cpe:2.3:a:nodejs:node.js:4.3.1:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.3.2

cpe:2.3:a:nodejs:node.js:4.3.2:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.4.0

cpe:2.3:a:nodejs:node.js:4.4.0:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.4.1

cpe:2.3:a:nodejs:node.js:4.4.1:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.4.2

cpe:2.3:a:nodejs:node.js:4.4.2:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.4.3

cpe:2.3:a:nodejs:node.js:4.4.3:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.4.4

cpe:2.3:a:nodejs:node.js:4.4.4:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.4.5

cpe:2.3:a:nodejs:node.js:4.4.5:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.4.6

cpe:2.3:a:nodejs:node.js:4.4.6:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.4.7

cpe:2.3:a:nodejs:node.js:4.4.7:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>4.5.0

cpe:2.3:a:nodejs:node.js:4.5.0:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.0

cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.1

cpe:2.3:a:nodejs:node.js:0.10.1:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.2

cpe:2.3:a:nodejs:node.js:0.10.2:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.3

cpe:2.3:a:nodejs:node.js:0.10.3:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.4

cpe:2.3:a:nodejs:node.js:0.10.4:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.5

cpe:2.3:a:nodejs:node.js:0.10.5:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.6

cpe:2.3:a:nodejs:node.js:0.10.6:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.7

cpe:2.3:a:nodejs:node.js:0.10.7:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.8

cpe:2.3:a:nodejs:node.js:0.10.8:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.9

cpe:2.3:a:nodejs:node.js:0.10.9:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.10

cpe:2.3:a:nodejs:node.js:0.10.10:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.11

cpe:2.3:a:nodejs:node.js:0.10.11:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.12

cpe:2.3:a:nodejs:node.js:0.10.12:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.13

cpe:2.3:a:nodejs:node.js:0.10.13:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.14

cpe:2.3:a:nodejs:node.js:0.10.14:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.15

cpe:2.3:a:nodejs:node.js:0.10.15:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.16

cpe:2.3:a:nodejs:node.js:0.10.16:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.16-isaacs-manual

cpe:2.3:a:nodejs:node.js:0.10.16-isaacs-manual:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.17

cpe:2.3:a:nodejs:node.js:0.10.17:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.18

cpe:2.3:a:nodejs:node.js:0.10.18:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.19

cpe:2.3:a:nodejs:node.js:0.10.19:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.20

cpe:2.3:a:nodejs:node.js:0.10.20:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.21

cpe:2.3:a:nodejs:node.js:0.10.21:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.22

cpe:2.3:a:nodejs:node.js:0.10.22:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.23

cpe:2.3:a:nodejs:node.js:0.10.23:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.24

cpe:2.3:a:nodejs:node.js:0.10.24:*:*:*:*:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>0.10.25

cpe:2.3:a:nodejs:node.js:0.10.25:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-113	Primary	nvd@nist.gov

CWE ID: CWE-113

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html	cve@mitre.org	Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0002.html	cve@mitre.org	N/A
http://www.securityfocus.com/bid/93483	cve@mitre.org	N/A
https://access.redhat.com/errata/RHSA-2016:2101	cve@mitre.org	N/A
https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762	cve@mitre.org	Issue Tracking Patch
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/	cve@mitre.org	Patch Vendor Advisory
https://security.gentoo.org/glsa/201612-43	cve@mitre.org	N/A
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0002.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/93483	af854a3a-2127-422b-91ae-364da2661108	N/A
https://access.redhat.com/errata/RHSA-2016:2101	af854a3a-2127-422b-91ae-364da2661108	N/A
https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking Patch
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://security.gentoo.org/glsa/201612-43	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: http://rhn.redhat.com/errata/RHSA-2017-0002.html

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/93483

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://access.redhat.com/errata/RHSA-2016:2101

Source: cve@mitre.org

Resource: N/A

Hyperlink: https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762

Source: cve@mitre.org

Resource:

Issue Tracking

Patch

Hyperlink: https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

Source: cve@mitre.org

Resource:

Patch

Vendor Advisory

Hyperlink: https://security.gentoo.org/glsa/201612-43

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://rhn.redhat.com/errata/RHSA-2017-0002.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/93483

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://access.redhat.com/errata/RHSA-2016:2101

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Issue Tracking

Patch

Hyperlink: https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Hyperlink: https://security.gentoo.org/glsa/201612-43

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A