CVE-2018-12116
published 2018-11-28CVE-2018-12116: Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
4.61%
90.6th percentile
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 10.15.0~dfsg-6 (bookworm) | nodejs 10.15.0~dfsg-6 (bookworm) |
| msrc | cm1_nodejs_14.17.2-1_on_cbl_mariner_1.0 | — | — |
| nodejs | node.js | 6.0.0 – 6.8.1 | — |
| nodejs | node.js | >= 6.9.0 < 6.15.0 | 6.15.0 |
| nodejs | node.js | 8.0.0 – 8.8.1 | — |
| nodejs | node.js | >= 8.9.0 < 8.14.0 | 8.14.0 |
| nodejs | nodejs | >= 0 < 10.15.0~dfsg-6 | 10.15.0~dfsg-6 |
| nodejs | nodejs | >= 0 < 10.15.0~dfsg-6 | 10.15.0~dfsg-6 |
| nodejs | nodejs | >= 0 < 10.15.0~dfsg-6 | 10.15.0~dfsg-6 |
| nodejs | nodejs | >= 0 < 10.15.0~dfsg-6 | 10.15.0~dfsg-6 |
| nodejs | nodejs | >= 0 < 0.10.25~dfsg2-2ubuntu1.2+esm1 | 0.10.25~dfsg2-2ubuntu1.2+esm1 |
| nodejs | nodejs | >= 0 < 4.2.6~dfsg-1ubuntu4.2+esm1 | 4.2.6~dfsg-1ubuntu4.2+esm1 |
| nodejs | nodejs | >= 0 < 8.10.0~dfsg-2ubuntu0.4+esm1 | 8.10.0~dfsg-2ubuntu0.4+esm1 |
| nodejs | undici | >= 0 < 5.8.0 | 5.8.0 |
| suse | suse_enterprise_storage | — | — |
| suse | suse_linux_enterprise_server | — | — |
| suse | suse_linux_enterprise_server | — | — |
| suse | suse_openstack_cloud | — | — |
| suse | suse_openstack_cloud | — | — |
| the_node.js_project | node.js | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5LOW
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
undici before v5.8.0 vulnerable to CRLF injection in request headers
ghsa·2022-07-21·CVSS 7.5
CVE-2022-31150 [HIGH] CWE-93 undici before v5.8.0 vulnerable to CRLF injection in request headers
undici before v5.8.0 vulnerable to CRLF injection in request headers
### Impact
It is possible to inject CRLF sequences into request headers in Undici.
```js
const undici = require('undici')
const response = undici.request("http://127.0.0.1:1000", {
headers: {'a': "\r\nb"}
})
```
The same applies to `path` and `method`
### Patches
Update to v5.8.0
### Workarounds
Sanitize all HTTP headers from untrusted sources to eliminate `\r\n`.
### References
https://hackerone.com/reports/409943
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [undici repository](https://github.com/nodejs/undici/issues)
* To make a report, follow the [SECURITY](https://github.com/nodejs/node
OSV
undici before v5.8.0 vulnerable to CRLF injection in request headers
osv·2022-07-21·CVSS 7.5
CVE-2022-31150 [HIGH] undici before v5.8.0 vulnerable to CRLF injection in request headers
undici before v5.8.0 vulnerable to CRLF injection in request headers
### Impact
It is possible to inject CRLF sequences into request headers in Undici.
```js
const undici = require('undici')
const response = undici.request("http://127.0.0.1:1000", {
headers: {'a': "\r\nb"}
})
```
The same applies to `path` and `method`
### Patches
Update to v5.8.0
### Workarounds
Sanitize all HTTP headers from untrusted sources to eliminate `\r\n`.
### References
https://hackerone.com/reports/409943
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [undici repository](https://github.com/nodejs/undici/issues)
* To make a report, follow the [SECURITY](https://github.com/nodejs/node
GHSA
GHSA-mfjx-w835-f3w2: Node
ghsa_unreviewed·2022-05-13
CVE-2018-12116 [HIGH] CWE-444 GHSA-mfjx-w835-f3w2: Node
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
OSV
nodejs vulnerabilities
osv·2021-03-15·CVSS 5.9
CVE-2016-7099 [MEDIUM] nodejs vulnerabilities
nodejs vulnerabilities
Alexander Minozhenko and James Bunton discovered that Node.js did not
properly handle wildcards in name fields of X.509 TLS certificates. An
attacker could use this vulnerability to execute a machine-in-the-middle-
attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)
It was discovered that Node.js incorrectly handled certain NAPTR responses.
A remote attacker could possibly use this issue to cause applications using
Node.js to crash, resulting in a denial of service. This issue only affected
Ubuntu 16.04 ESM. (CVE-2017-1000381)
Nikita Skovoroda discovered that Node.js mishandled certain input, leading
to an out of bounds write. An attacker could use this vulnerability to
cause a denial of service (crash) or possibly execute arbitrary co
OSV
CVE-2018-12116: Node
osv·2018-11-28·CVSS 7.5
CVE-2018-12116 [HIGH] CVE-2018-12116: Node
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
Ubuntu
Node.js vulnerabilities
vendor_ubuntu·2021-03-15·CVSS 5.9
CVE-2018-7160 [MEDIUM] Node.js vulnerabilities
Title: Node.js vulnerabilities
Summary: Several security issues were fixed in Node.js.
Alexander Minozhenko and James Bunton discovered that Node.js did not
properly handle wildcards in name fields of X.509 TLS certificates. An
attacker could use this vulnerability to execute a machine-in-the-middle-
attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)
It was discovered that Node.js incorrectly handled certain NAPTR responses.
A remote attacker could possibly use this issue to cause applications using
Node.js to crash, resulting in a denial of service. This issue only affected
Ubuntu 16.04 ESM. (CVE-2017-1000381)
Nikita Skovoroda discovered that Node.js mishandled certain input, leading
to an out of bounds write. An attacker could use this vulnerability to
c
Red Hat
nodejs: HTTP request splitting
vendor_redhat·2018-11-27·CVSS 7.5
CVE-2018-12116 [HIGH] CWE-113 nodejs: HTTP request splitting
nodejs: HTTP request splitting
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
Statement: The nodejs RPMs shipped in Red Hat OpenShift Container Platform (OCP) versions 3.6 through 3.10 are vulnerable to this flaw because they contain the affected code. Later versions of OCP used nodejs RPMs delivered from Red Hat Software Collections and Red Hat Enterprise Linux channels.
Package: nodejs (Red Hat Enterprise Linux 8) - Not affected
Package: nodejs (Red Hat OpenShift Application Runtimes) - Not affected
Package: nod
Microsoft
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request the
vendor_msrc·2018-11-13·CVSS 7.5
CVE-2018-12116 [HIGH] CWE-115 Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request the
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request then data can be provided which will trigger a second unexpected and user-defined HTTP request to made to the same server.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in Oc
Debian
CVE-2018-12116: nodejs - Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting...
vendor_debian·2018·CVSS 7.5
CVE-2018-12116 [HIGH] CVE-2018-12116: nodejs - Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting...
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
Scope: local
bookworm: resolved (fixed in 10.15.0~dfsg-6)
bullseye: resolved (fixed in 10.15.0~dfsg-6)
forky: resolved (fixed in 10.15.0~dfsg-6)
sid: resolved (fixed in 10.15.0~dfsg-6)
trixie: resolved (fixed in 10.15.0~dfsg-6)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-12116 nodejs: HTTP request splitting [fedora-all]
bugzilla·2018-12-19·CVSS 7.5
CVE-2018-12116 [HIGH] CVE-2018-12116 nodejs: HTTP request splitting [fedora-all]
CVE-2018-12116 nodejs: HTTP request splitting [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While o
Bugzilla
CVE-2018-12116 nodejs: HTTP request splitting
bugzilla·2018-12-19·CVSS 7.5
CVE-2018-12116 [HIGH] CVE-2018-12116 nodejs: HTTP request splitting
CVE-2018-12116 nodejs: HTTP request splitting
A flaw was found in Node.js before 6.15.0 and 8.14.0. An HTTP request splitting. If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
References:
https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
Discussion:
Created nodejs tracking bugs for this issue:
Affects: epel-all [bug 1661000]
Affects: fedora-all [bug 1660999]
---
Upstream fixes:
node.js 8 : https://github.com/nodejs/node/commit/513e9747a22
master: https://github.com/nodejs/node/commit/b961d9fd83c
---
Statement:
The nodejs RPMs shipped in Red Hat OpenShift Container P
Bugzilla
CVE-2018-12116 nodejs: HTTP request splitting [epel-all]
bugzilla·2018-12-19·CVSS 7.5
CVE-2018-12116 [HIGH] CVE-2018-12116 nodejs: HTTP request splitting [epel-all]
CVE-2018-12116 nodejs: HTTP request splitting [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora EPEL. While
https://access.redhat.com/errata/RHSA-2019:1821https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/https://security.gentoo.org/glsa/202003-48https://access.redhat.com/errata/RHSA-2019:1821https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/https://security.gentoo.org/glsa/202003-48
2018-11-28
Published