CVE-2018-12116CWE-115

CVE-2018-12116

High · published November 28, 2018

CVSS v3.1

7.5

EPSS

Percentile

91.6

In the wild

Unconfirmed

What it is

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.04574 · 91.6th percentile
Weakness: CWE-115 · Misinterpretation of Input
Published: 2018-11-28T22:29Z

Affected products (9)

Product	Versions	Fixed in
nodejs/node.js	≥ 6.0.0, ≤ 6.8.1	—
nodejs/node.js	≥ 6.9.0, < 6.15.0	6.15.0
nodejs/node.js	≥ 8.0.0, ≤ 8.8.1	—
nodejs/node.js	≥ 8.9.0, < 8.14.0	8.14.0
suse/suse_enterprise_storage	all versions	—
suse/suse_linux_enterprise_server	all versions	—
suse/suse_linux_enterprise_server	all versions	—
suse/suse_openstack_cloud	all versions	—
suse/suse_openstack_cloud	all versions	—

References (6)

https://access.redhat.com/errata/RHSA-2019:1821 · [email protected]https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ · [email protected]https://security.gentoo.org/glsa/202003-48 · [email protected]https://access.redhat.com/errata/RHSA-2019:1821 · af854a3a-2127-422b-91ae-364da2661108 https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ · af854a3a-2127-422b-91ae-364da2661108 https://security.gentoo.org/glsa/202003-48 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

28 NOV 17:00Z
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for…
cvelistv5