High severity7.5NVD Advisory· Published Jul 2, 2016· Updated Jun 17, 2026
CVE-2016-3956
CVE-2016-3956
Description
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
npmnpm | < 2.15.1 | 2.15.1 |
npmnpm | >= 3.0.0, < 3.8.3 | 3.8.3 |
Affected products
205cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*+ 89 more
- cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.10:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.11:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.12:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.13:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.14:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.15:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.16:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.16-isaacs-manual:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.17:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.18:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.19:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.20:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.21:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.22:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.23:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.24:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.25:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.26:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.27:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.28:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.29:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.30:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.31:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.32:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.33:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.34:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.35:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.36:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.37:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.38:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.39:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.40:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.41:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.8:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.9:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.7:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.8:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.9:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.1:rc.1:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.1:rc.2:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.0:rc.1:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.0:rc.2:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.0:rc.3:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.0:rc.4:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.8.1:rc.1:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:5.9.1:*:*:*:*:*:*:*
- osv-coords113 versionspkg:apk/chainguard/code-serverpkg:apk/chainguard/code-server-compatpkg:apk/chainguard/gitlab-rails-ce-18.1pkg:apk/chainguard/gitlab-rails-ce-18.2pkg:apk/chainguard/gitlab-rails-ce-18.3pkg:apk/chainguard/gitlab-rails-ce-18.4pkg:apk/chainguard/gitlab-rails-ce-18.5pkg:apk/chainguard/gitlab-rails-ce-18.6pkg:apk/chainguard/gitlab-rails-ce-18.7pkg:apk/chainguard/gitlab-rails-ce-assets-18.1pkg:apk/chainguard/gitlab-rails-ce-assets-18.10pkg:apk/chainguard/gitlab-rails-ce-assets-18.11pkg:apk/chainguard/gitlab-rails-ce-assets-18.2pkg:apk/chainguard/gitlab-rails-ce-assets-18.3pkg:apk/chainguard/gitlab-rails-ce-assets-18.4pkg:apk/chainguard/gitlab-rails-ce-assets-18.5pkg:apk/chainguard/gitlab-rails-ce-assets-18.6pkg:apk/chainguard/gitlab-rails-ce-assets-18.7pkg:apk/chainguard/gitlab-rails-ce-assets-18.8pkg:apk/chainguard/gitlab-rails-ce-assets-18.9pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.1pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.10pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.11pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.2pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.3pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.4pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.5pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.6pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.7pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.8pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.9pkg:apk/chainguard/gitlab-rails-ce-doc-18.1pkg:apk/chainguard/gitlab-rails-ce-doc-18.2pkg:apk/chainguard/gitlab-rails-ce-doc-18.3pkg:apk/chainguard/gitlab-rails-ce-doc-18.4pkg:apk/chainguard/gitlab-rails-ce-doc-18.5pkg:apk/chainguard/gitlab-rails-ce-doc-18.6pkg:apk/chainguard/gitlab-rails-ce-doc-18.7pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.1pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.2pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.3pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.4pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.5pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.6pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.7pkg:apk/chainguard/gitlab-rails-ce-fips-18.1pkg:apk/chainguard/gitlab-rails-ce-fips-18.2pkg:apk/chainguard/gitlab-rails-ce-fips-18.3pkg:apk/chainguard/gitlab-rails-ce-fips-18.4pkg:apk/chainguard/gitlab-rails-ce-fips-18.5pkg:apk/chainguard/gitlab-rails-ce-fips-18.6pkg:apk/chainguard/gitlab-rails-ce-fips-18.7pkg:apk/chainguard/gitlab-rails-ee-17.0pkg:apk/chainguard/gitlab-rails-ee-17.1pkg:apk/chainguard/gitlab-rails-ee-17.10pkg:apk/chainguard/gitlab-rails-ee-17.11pkg:apk/chainguard/gitlab-rails-ee-17.2pkg:apk/chainguard/gitlab-rails-ee-17.3pkg:apk/chainguard/gitlab-rails-ee-17.4pkg:apk/chainguard/gitlab-rails-ee-17.6pkg:apk/chainguard/gitlab-rails-ee-17.7pkg:apk/chainguard/gitlab-rails-ee-17.8pkg:apk/chainguard/gitlab-rails-ee-17.9pkg:apk/chainguard/gitlab-rails-ee-assets-17.10pkg:apk/chainguard/gitlab-rails-ee-assets-17.11pkg:apk/chainguard/gitlab-rails-ee-assets-17.2pkg:apk/chainguard/gitlab-rails-ee-assets-17.3pkg:apk/chainguard/gitlab-rails-ee-assets-17.4pkg:apk/chainguard/gitlab-rails-ee-assets-17.6pkg:apk/chainguard/gitlab-rails-ee-assets-17.7pkg:apk/chainguard/gitlab-rails-ee-assets-17.8pkg:apk/chainguard/gitlab-rails-ee-assets-17.9pkg:apk/chainguard/gitlab-rails-ee-assets-fips-17.10pkg:apk/chainguard/gitlab-rails-ee-assets-fips-17.11pkg:apk/chainguard/gitlab-rails-ee-assets-fips-17.2pkg:apk/chainguard/gitlab-rails-ee-assets-fips-17.3pkg:apk/chainguard/gitlab-rails-ee-assets-fips-17.4pkg:apk/chainguard/gitlab-rails-ee-assets-fips-17.6pkg:apk/chainguard/gitlab-rails-ee-assets-fips-17.7pkg:apk/chainguard/gitlab-rails-ee-assets-fips-17.8pkg:apk/chainguard/gitlab-rails-ee-assets-fips-17.9pkg:apk/chainguard/gitlab-rails-ee-doc-17.10pkg:apk/chainguard/gitlab-rails-ee-doc-17.11pkg:apk/chainguard/gitlab-rails-ee-doc-17.2pkg:apk/chainguard/gitlab-rails-ee-doc-17.3pkg:apk/chainguard/gitlab-rails-ee-doc-17.4pkg:apk/chainguard/gitlab-rails-ee-doc-17.6pkg:apk/chainguard/gitlab-rails-ee-doc-17.7pkg:apk/chainguard/gitlab-rails-ee-doc-17.8pkg:apk/chainguard/gitlab-rails-ee-doc-17.9pkg:apk/chainguard/gitlab-rails-ee-doc-fips-17.10pkg:apk/chainguard/gitlab-rails-ee-doc-fips-17.11pkg:apk/chainguard/gitlab-rails-ee-doc-fips-17.2pkg:apk/chainguard/gitlab-rails-ee-doc-fips-17.3pkg:apk/chainguard/gitlab-rails-ee-doc-fips-17.4pkg:apk/chainguard/gitlab-rails-ee-doc-fips-17.6pkg:apk/chainguard/gitlab-rails-ee-doc-fips-17.7pkg:apk/chainguard/gitlab-rails-ee-doc-fips-17.8pkg:apk/chainguard/gitlab-rails-ee-doc-fips-17.9pkg:apk/chainguard/gitlab-rails-ee-fips-17.0pkg:apk/chainguard/gitlab-rails-ee-fips-17.1pkg:apk/chainguard/gitlab-rails-ee-fips-17.10pkg:apk/chainguard/gitlab-rails-ee-fips-17.11pkg:apk/chainguard/gitlab-rails-ee-fips-17.2pkg:apk/chainguard/gitlab-rails-ee-fips-17.3pkg:apk/chainguard/gitlab-rails-ee-fips-17.4pkg:apk/chainguard/gitlab-rails-ee-fips-17.6pkg:apk/chainguard/gitlab-rails-ee-fips-17.7pkg:apk/chainguard/gitlab-rails-ee-fips-17.8pkg:apk/chainguard/gitlab-rails-ee-fips-17.9pkg:apk/wolfi/code-serverpkg:apk/wolfi/code-server-compatpkg:npm/npm
< 0+ 112 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 2.15.1
Patches
Vulnerability mechanics
References
10- github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29nvdPatchThird Party AdvisoryWEB
- github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401nvdPatchThird Party AdvisoryWEB
- blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerabilitynvdVendor AdvisoryWEB
- www-01.ibm.com/support/docview.wssnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-m5h6-hr3q-22h5ghsaADVISORY
- github.com/npm/npm/issues/8380nvdThird Party AdvisoryWEB
- nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/nvdVendor Advisory
- nvd.nist.gov/vuln/detail/CVE-2016-3956ghsaADVISORY
- nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016ghsaWEB
- www.npmjs.com/advisories/98ghsaWEB
News mentions
0No linked articles in our index yet.