HTTP Response Splitting Affecting nodejs package, versions *


Severity

Recommended
medium

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.13% (50th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-NODEJS-5245043
  • published1 Nov 2021
  • disclosed27 Nov 2018

Introduced: 27 Nov 2018

CVE-2018-12116  (opens in a new tab)
CWE-113  (opens in a new tab)

How to fix?

There is no fixed version for RHEL:7 nodejs.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs package and not the nodejs package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

CVSS Scores

version 3.1