Medium severity5.9NVD Advisory· Published Oct 10, 2016· Updated Jun 17, 2026

CVE-2016-7099

Description

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

113

Node.js/Node.js98 versions
cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*+ 97 more
- cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.10:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.11:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.12:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.13:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.14:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.15:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.16:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.16-isaacs-manual:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.17:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.18:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.19:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.20:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.21:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.22:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.23:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.24:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.25:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.26:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.27:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.28:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.29:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.30:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.31:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.32:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.33:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.34:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.35:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.36:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.37:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.38:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.39:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.40:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.41:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.42:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.43:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.44:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.45:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.46:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.8:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.10.9:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.10:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.11:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.12:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.13:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.14:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.15:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.7:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.8:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:0.12.9:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:nodejs:node.js:6.6.0:*:*:*:*:*:*:*
- (no CPE)range: <0.10.47, <0.12.16, <4.6.0, <6.7.0
SUSE S.A./Linux Enterprise Desktop
cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*
osv-coords14 versions
pkg:rpm/suse/firefox-atk&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-cairo&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-gdk-pixbuf&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-glib2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-harfbuzz&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-libffi&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-libffi-gcc5&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/firefox-pango&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLED&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS pkg:rpm/suse/nodejs4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012
< 2.26.1-2.8.4+ 13 more
- (no CPE)range: < 2.26.1-2.8.4
- (no CPE)range: < 1.15.10-2.13.4
- (no CPE)range: < 2.36.11-2.8.4
- (no CPE)range: < 2.54.3-2.14.7
- (no CPE)range: < 3.10.9-2.15.3
- (no CPE)range: < 1.7.5-2.7.4
- (no CPE)range: < 3.2.1.git259-2.3.3
- (no CPE)range: < 5.3.1+r233831-14.1
- (no CPE)range: < 1.40.14-2.7.4
- (no CPE)range: < 68-21.9.8
- (no CPE)range: < 68.2.0-78.51.4
- (no CPE)range: < 4.21-29.6.1
- (no CPE)range: < 3.45-38.9.3
- (no CPE)range: < 4.6.0-8.1

Patches

Vulnerability mechanics

References

github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20bnvdIssue TrackingPatch
nodejs.org/en/blog/vulnerability/september-2016-security-releases/nvdPatchVendor Advisory
lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlnvdThird Party Advisory
www.securityfocus.com/bid/93191nvdThird Party AdvisoryVDB Entry
rhn.redhat.com/errata/RHSA-2017-0002.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000