UpHeron
All vulnerabilities

Servers and applications

CVE-2016-5325

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

Severity
Medium 6.1
Published
10 Oct 2016
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • Version 6.6.0
  • Version 6.5.0
  • Version 6.4.0
  • Version 6.3.1
All 97 release lines
  • Version 0.10.0
  • Version 0.10.1
  • Version 0.10.2
  • Version 0.10.3
  • Version 0.10.4
  • Version 0.10.5
  • Version 0.10.6
  • Version 0.10.7
  • Version 0.10.8
  • Version 0.10.9
  • Version 0.10.10
  • Version 0.10.11
  • Version 0.10.12
  • Version 0.10.13
  • Version 0.10.14
  • Version 0.10.15
  • Version 0.10.16
  • Version 0.10.16-isaacs-manual
  • Version 0.10.17
  • Version 0.10.18
  • Version 0.10.19
  • Version 0.10.20
  • Version 0.10.21
  • Version 0.10.22
  • Version 0.10.23
  • Version 0.10.24
  • Version 0.10.25
  • Version 0.10.26
  • Version 0.10.27
  • Version 0.10.28
  • Version 0.10.29
  • Version 0.10.30
  • Version 0.10.31
  • Version 0.10.32
  • Version 0.10.33
  • Version 0.10.34
  • Version 0.10.35
  • Version 0.10.36
  • Version 0.10.37
  • Version 0.10.38
  • Version 0.10.39
  • Version 0.10.40
  • Version 0.10.41
  • Version 0.10.42
  • Version 0.10.43
  • Version 0.10.44
  • Version 0.10.45
  • Version 0.10.46
  • Version 0.12.0
  • Version 0.12.1
  • Version 0.12.2
  • Version 0.12.3
  • Version 0.12.4
  • Version 0.12.5
  • Version 0.12.6
  • Version 0.12.7
  • Version 0.12.8
  • Version 0.12.9
  • Version 0.12.10
  • Version 0.12.11
  • Version 0.12.12
  • Version 0.12.13
  • Version 0.12.14
  • Version 0.12.15
  • Version 4.0.0
  • Version 4.1.0
  • Version 4.1.1
  • Version 4.1.2
  • Version 4.2.0
  • Version 4.2.1
  • Version 4.2.2
  • Version 4.2.3
  • Version 4.2.4
  • Version 4.2.5
  • Version 4.2.6
  • Version 4.3.0
  • Version 4.3.1
  • Version 4.3.2
  • Version 4.4.0
  • Version 4.4.1
  • Version 4.4.2
  • Version 4.4.3
  • Version 4.4.4
  • Version 4.4.5
  • Version 4.4.6
  • Version 4.4.7
  • Version 4.5.0
  • Version 6.0.0
  • Version 6.1.0
  • Version 6.2.0
  • Version 6.2.1
  • Version 6.2.2
  • Version 6.3.0
  • Version 6.3.1
  • Version 6.4.0
  • Version 6.5.0
  • Version 6.6.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-5325
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-5325