UpHeron
All vulnerabilities

Servers and applications

CVE-2016-7099

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Severity
Medium 5.9
Published
10 Oct 2016
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • Version 6.6.0
  • Version 6.5.0
  • Version 6.4.0
  • Version 6.3.1
All 97 release lines
  • Version 0.10.0
  • Version 0.10.1
  • Version 0.10.2
  • Version 0.10.3
  • Version 0.10.4
  • Version 0.10.5
  • Version 0.10.6
  • Version 0.10.7
  • Version 0.10.8
  • Version 0.10.9
  • Version 0.10.10
  • Version 0.10.11
  • Version 0.10.12
  • Version 0.10.13
  • Version 0.10.14
  • Version 0.10.15
  • Version 0.10.16
  • Version 0.10.16-isaacs-manual
  • Version 0.10.17
  • Version 0.10.18
  • Version 0.10.19
  • Version 0.10.20
  • Version 0.10.21
  • Version 0.10.22
  • Version 0.10.23
  • Version 0.10.24
  • Version 0.10.25
  • Version 0.10.26
  • Version 0.10.27
  • Version 0.10.28
  • Version 0.10.29
  • Version 0.10.30
  • Version 0.10.31
  • Version 0.10.32
  • Version 0.10.33
  • Version 0.10.34
  • Version 0.10.35
  • Version 0.10.36
  • Version 0.10.37
  • Version 0.10.38
  • Version 0.10.39
  • Version 0.10.40
  • Version 0.10.41
  • Version 0.10.42
  • Version 0.10.43
  • Version 0.10.44
  • Version 0.10.45
  • Version 0.10.46
  • Version 0.12.0
  • Version 0.12.1
  • Version 0.12.2
  • Version 0.12.3
  • Version 0.12.4
  • Version 0.12.5
  • Version 0.12.6
  • Version 0.12.7
  • Version 0.12.8
  • Version 0.12.9
  • Version 0.12.10
  • Version 0.12.11
  • Version 0.12.12
  • Version 0.12.13
  • Version 0.12.14
  • Version 0.12.15
  • Version 4.0.0
  • Version 4.1.0
  • Version 4.1.1
  • Version 4.1.2
  • Version 4.2.0
  • Version 4.2.1
  • Version 4.2.2
  • Version 4.2.3
  • Version 4.2.4
  • Version 4.2.5
  • Version 4.2.6
  • Version 4.3.0
  • Version 4.3.1
  • Version 4.3.2
  • Version 4.4.0
  • Version 4.4.1
  • Version 4.4.2
  • Version 4.4.3
  • Version 4.4.4
  • Version 4.4.5
  • Version 4.4.6
  • Version 4.4.7
  • Version 4.5.0
  • Version 6.0.0
  • Version 6.1.0
  • Version 6.2.0
  • Version 6.2.1
  • Version 6.2.2
  • Version 6.3.0
  • Version 6.3.1
  • Version 6.4.0
  • Version 6.5.0
  • Version 6.6.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-7099
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-7099