UpHeron
All vulnerabilities

Servers and applications

CVE-2016-2216

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

Severity
High 7.5
Published
7 Apr 2016
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • Version 5.5.0
  • Version 5.4.1
  • Version 5.4.0
  • Version 5.3.0
All 83 release lines
  • Version 0.10.0
  • Version 0.10.1
  • Version 0.10.2
  • Version 0.10.3
  • Version 0.10.4
  • Version 0.10.5
  • Version 0.10.6
  • Version 0.10.7
  • Version 0.10.8
  • Version 0.10.9
  • Version 0.10.10
  • Version 0.10.11
  • Version 0.10.12
  • Version 0.10.13
  • Version 0.10.14
  • Version 0.10.15
  • Version 0.10.16
  • Version 0.10.16-isaacs-manual
  • Version 0.10.17
  • Version 0.10.18
  • Version 0.10.19
  • Version 0.10.20
  • Version 0.10.21
  • Version 0.10.22
  • Version 0.10.23
  • Version 0.10.24
  • Version 0.10.25
  • Version 0.10.26
  • Version 0.10.27
  • Version 0.10.28
  • Version 0.10.29
  • Version 0.10.30
  • Version 0.10.31
  • Version 0.10.32
  • Version 0.10.33
  • Version 0.10.34
  • Version 0.10.35
  • Version 0.10.36
  • Version 0.10.37
  • Version 0.10.38
  • Version 0.10.39
  • Version 0.10.40
  • Version 0.10.41
  • Version 0.11.6
  • Version 0.11.7
  • Version 0.11.8
  • Version 0.11.9
  • Version 0.11.10
  • Version 0.11.11
  • Version 0.11.12
  • Version 0.11.13
  • Version 0.11.14
  • Version 0.11.15
  • Version 0.11.16
  • Version 0.12.0
  • Version 0.12.1
  • Version 0.12.2
  • Version 0.12.3
  • Version 0.12.4
  • Version 0.12.5
  • Version 0.12.6
  • Version 0.12.7
  • Version 0.12.8
  • Version 0.12.9
  • Version 4.0.0
  • Version 4.1.0
  • Version 4.1.1
  • Version 4.1.2
  • Version 4.2.0
  • Version 4.2.1
  • Version 4.2.2
  • Version 4.2.3
  • Version 4.2.4
  • Version 4.2.5
  • Version 4.2.6
  • Version 5.0.0
  • Version 5.1.0
  • Version 5.1.1
  • Version 5.2.0
  • Version 5.3.0
  • Version 5.4.0
  • Version 5.4.1
  • Version 5.5.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-2216
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-2216