CVE-2016-7099

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle…

published October 10, 2016

CVSS
—
EPSS
3%
Percentile
86.5
In the wild
Unconfirmed
What it is

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02841 · 86.5th percentile
Published
2016-10-10T16:00Z
EPSS history
Timeline
  • 10 OCT 16:00Z
    The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle…
    cvelistv5