Medium severity6.1NVD Advisory· Published Oct 10, 2016· Updated Jun 17, 2026

CVE-2016-5325

Description

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

113

Node.js/Node.js98 versions
cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*+ 97 more
- cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.10:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.11:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.12:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.13:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.14:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.15:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.16:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.16-isaacs-manual:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.17:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.18:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.19:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.20:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.21:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.22:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.23:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.24:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.25:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.26:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.27:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.28:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.29:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.30:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.31:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.32:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.33:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.34:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.35:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.36:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.37:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.38:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.39:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.40:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.41:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.42:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.43:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.44:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.45:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.46:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.8:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.9:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.10:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.11:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.12:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.13:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.14:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.15:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.7:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.8:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.9:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.6.0:*:*:*:*:*:*:*
- (no CPE)range: < 0.10.47, < 0.12.16, < 4.6.0, < 6.7.0
SUSE S.A./Linux Enterprise Desktop
cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*
osv-coords14 versions
pkg:rpm/suse/firefox-atk&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-cairo&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-gdk-pixbuf&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-glib2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-harfbuzz&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-libffi&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-libffi-gcc5&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-pango&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLED&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/nodejs4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012
< 2.26.1-2.8.4+ 13 more
- (no CPE)range: < 2.26.1-2.8.4
- (no CPE)range: < 1.15.10-2.13.4
- (no CPE)range: < 2.36.11-2.8.4
- (no CPE)range: < 2.54.3-2.14.7
- (no CPE)range: < 3.10.9-2.15.3
- (no CPE)range: < 1.7.5-2.7.4
- (no CPE)range: < 3.2.1.git259-2.3.3
- (no CPE)range: < 5.3.1+r233831-14.1
- (no CPE)range: < 1.40.14-2.7.4
- (no CPE)range: < 68-21.9.8
- (no CPE)range: < 68.2.0-78.51.4
- (no CPE)range: < 4.21-29.6.1
- (no CPE)range: < 3.45-38.9.3
- (no CPE)range: < 4.6.0-8.1

Patches

Vulnerability mechanics

References

github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762nvdIssue TrackingPatch
nodejs.org/en/blog/vulnerability/september-2016-security-releases/nvdPatchVendor Advisory
lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlnvdThird Party Advisory
rhn.redhat.com/errata/RHSA-2017-0002.htmlnvd
www.securityfocus.com/bid/93483nvd
access.redhat.com/errata/RHSA-2016:2101nvd
security.gentoo.org/glsa/201612-43nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000