CVE-2016-2216

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2016-2216
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2216.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-2216
Downstream
Related
Published
2016-04-07T21:59:02Z
Modified
2025-10-10T02:26:40.936790Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0034086b49f22cfde765a7e9f55db25f8eb310b6
Last affected
02fd81a89f490002f032d06a48b30f4caa957afe
Last affected
03431c7d7b4b4a3054ca8ae2cfa8009e3e84a2c7
Last affected
04018d4b3938fd30ba14822e79195e4af2be36f6
Last affected
0439a28d519fb6efe228074b0588a59452fc1677
Last affected
0462bc23564e7e950a70ae4577a840b04db6c7c6
Last affected
09b482886bdd3d863c3d4e7d71264eac0daaf9e1
Last affected
0a604e92e258c5ee2752d763e50721e35053f135
Last affected
0b5731a63cc40c4fe9275c79158fe0a5dd4d1609
Last affected
0be9a77bb18ec15b4fb6a1fb0762f313b7351201
Last affected
0cdc54a2bb1f17297ac4c418fdbe6df00e049b00
Last affected
0fe0d121551593c23a565db8397f85f17bb0f00e
Last affected
11433127c717b02859c9aef063217b5a0797e6b3
Last affected
13151aae1a5e6e22052efd1816cc35bc1aae377c
Last affected
163ca274230fce536afe76c64676c332693ad7c1
Last affected
1e0de9c426e07a260bbec2d2196c2d2db8eb8886
Last affected
2426d65af860bda7be9f0832a99601cc43c6cf63
Last affected
25e51c396aa23018603baae2b1d9390f5d9db496
Last affected
2b18916ff054309a07408719b62e2b6a4f1e056a
Last affected
2f947e966588d46f85a49e387b8b107e575dff1d
Last affected
30d9e9fdd9d4c33d3d95a129d021cd8b5b91eddb
Last affected
384e6c2dfe968002800bc3d3224a57aa19ffdfee
Last affected
469a4a5091a677df62be319675056b869c31b35c
Last affected
50b4c905a4425430ae54db4906f88982309e128d
Last affected
523d445705027438b83b8d5958c9beeb1c8711d9
Last affected
52795f8fcc2de77cf997e671ea58614e5e425dfe
Last affected
5deb1672f2b5794f8be19498a425ea4dc0b0711f
Last affected
615a35ccd2cb5cba80901862aefe51a940995f44
Last affected
61c6abf00898fe00eb7fcf2c23ba0b01cf12034c
Last affected
65b86c0a3da6ebf21ca8021fc2ef3400945c6c55
Last affected
66931791f06207d1cdfea5ec1529edf3c94026d3
Last affected
67a1f0c52e0708e2596f3f2134b8386d6112561e
Last affected
6b0352d79a67e4b7036177442156400f26253eef
Last affected
6b5e6a5a3ec8d994c9aab3b800b9edbf1b287904
Last affected
6dc12b1042d5d4727f77e8a1c5758dab91400069
Last affected
7d6b5b1d5ba726331f9ccaaae59af7cd53eee82e
Last affected
7d6b8db40f32e817ff145b7cfe6b3aec3179fba7
Last affected
7fabdc23d843cb705d2d0739e7bbdaaf50aa3292
Last affected
85df6ada477715020dbd22e2fb5e687d84d663ff
Last affected
878ffdbe6a8eac918ef3a7f13925681c3778060b
Last affected
8a9f263a82089814e69f277f9fecd2888705101b
Last affected
8d045a30e95602b443eb259a5021d33feb4df079
Last affected
8e42e5a0731040075e14cec087eea86729f2dc53
Last affected
902090af5375e497dded310575f19de5328a9bbc
Last affected
9712aa9f76073c30850b20a188b1ed12ffb74d17
Last affected
99c9930ad626e2796af23def7cac19b65c608d18
Last affected
a088cf4f930d3928c97d239adf950ab43e7794aa
Last affected
a363f61ca839e817eb6853c5dc5af8c3b9b9226b
Last affected
aa1e9a42f7188986d1aaa5c081d80230fd8ee54a
Last affected
ab55b45b2e447237df3f5fee429ae3f06693ad0e
Last affected
af591d494070a978d23fdb6c7c46ff52060b61b1
Last affected
b0e5f195dfce3e2b99f5091373d49f6616682596
Last affected
b148cbe09d4657766fdb61575ba985734c2ff0a8
Last affected
b21110f8a70b809b57b2c6639006674b6c6fe0b3
Last affected
b46e77421581ea358e221a8a843d057c747f7e90
Last affected
b4ec2c2ab8fa53fb6e8192eed0965732d56a9160
Last affected
b7eff480d8fbeb0576bb98ca771fb1ad6f48e864
Last affected
b7fd6bc899ccb629d790c47aee06aba87e535c41
Last affected
bc0ff830aff1e016163d855e86ded5c98b0899e8
Last affected
bcf6ac1960a8b5b3be5f24c10ec4c5e2ba0a60fa
Last affected
be52549bfa5311208b5fcdb3ba09210460fa9ceb
Last affected
c274d1643589bf104122674a8c3fd147527a667d
Last affected
cb7911f78ae96ef7a540df992cc1359ba9636e86
Last affected
cbff8f091c22fb1df6b238c7a1b9145db950fa65
Last affected
cc56c62ed879ad4f93b1fdab3235c43e60f48b7e
Last affected
ce82d6b8474bde7ac7df6d425fb88fb1bcba35bc
Last affected
d2fdae197ac542f686ee06835d1153dd43b862e5
Last affected
d3492aa7b386946e3a156440cad346e5b0a82838
Last affected
d4982f6f5e4a9a703127489a553b8d782997ea43
Last affected
d7234c8d50a1af73f60d2d3c0cc7eed17429a481
Last affected
d9d5bc465450ae5d60da32e9ffcf71c2767f1fad
Last affected
dcfd032bdd69dfb38c120e18438d6316ae522edc
Last affected
dd882563e56652f76e25994d046ab49b1bc5f836
Last affected
deeaf8fab978e3cadb364e46fb32dafdebe5f095
Last affected
e2da042844a830fafb8031f6c477eb4f96195210
Last affected
e32660a984427d46af6a144983cf7b8045b7299c
Last affected
e6ca04cfd5f09ee5b536878bcb96f55d57fae68a
Last affected
f8d86e24f3463c36f7f3f4c3b3ec779e5b6201e1
Last affected
f9f837885343a2a3f5ba2b8c510eaac395c8c865
Last affected
fdf57f811f9683a4ec49a74dc7226517e32e6c9d
Last affected
ff992037246010fdad6f72323fe556da69640531
Last affected
ffc1395af0d5495be442eaefd9ce4dd6561c6dba

Affected versions

v0.*

v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.1.0
v0.1.1
v0.1.10
v0.1.100
v0.1.101
v0.1.102
v0.1.103
v0.1.104
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.2
v0.1.20
v0.1.21
v0.1.22
v0.1.23
v0.1.24
v0.1.25
v0.1.26
v0.1.27
v0.1.28
v0.1.29
v0.1.3
v0.1.30
v0.1.31
v0.1.32
v0.1.33
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.1.90
v0.1.91
v0.1.92
v0.1.93
v0.1.94
v0.1.95
v0.1.96
v0.1.97
v0.1.98
v0.1.99
v0.10.0
v0.10.1
v0.10.10
v0.10.11
v0.10.12
v0.10.13
v0.10.14
v0.10.15
v0.10.16
v0.10.17
v0.10.18
v0.10.19
v0.10.2
v0.10.20
v0.10.21
v0.10.22
v0.10.23
v0.10.24
v0.10.25
v0.10.26
v0.10.27
v0.10.28
v0.10.29
v0.10.3
v0.10.30
v0.10.31
v0.10.32
v0.10.33
v0.10.34
v0.10.35
v0.10.36
v0.10.37
v0.10.38
v0.10.39
v0.10.4
v0.10.40
v0.10.5
v0.10.6
v0.10.7
v0.10.8
v0.10.9
v0.11.0
v0.11.1
v0.11.10
v0.11.11
v0.11.12
v0.11.13
v0.11.15
v0.11.16
v0.11.2
v0.11.3
v0.11.4
v0.11.5
v0.11.6
v0.11.7
v0.11.8
v0.11.9
v0.12.0
v0.12.1
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.4.0
v0.4.1
v0.4.10
v0.4.11
v0.4.12
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.1
v0.5.10
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.5-rc1
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.6.10
v0.6.11
v0.6.12
v0.6.13
v0.6.14
v0.6.15
v0.6.16
v0.6.17
v0.6.18
v0.6.19
v0.6.2
v0.6.20
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.7
v0.6.8
v0.6.9
v0.7.0
v0.7.1
v0.7.10
v0.7.11
v0.7.12
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.1
v0.8.10
v0.8.11
v0.8.12
v0.8.13
v0.8.14
v0.8.15
v0.8.16
v0.8.17
v0.8.18
v0.8.19
v0.8.2
v0.8.20
v0.8.21
v0.8.22
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.10
v0.9.11
v0.9.12
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9

v1.*

v1.0.0
v1.0.0-release
v1.0.1
v1.0.1-release
v1.0.2
v1.0.2-release
v1.0.3
v1.0.4
v1.1.0
v1.2.0
v1.3.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.7.0
v1.7.1
v1.8.1

v2.*

v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.5.0

v3.*

v3.0.0

v5.*

v5.0.0
v5.1.0