Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00707
Percentile: 0.71232

CVSS Scoring

Mapped CWE(s)

• CWE-115 : Misinterpretation of Input

Affected Products

• cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
• cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
• cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
• cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
• cpe:2.3:a:suse:suse_enterprise_storage:4:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_openstack_cloud:7:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*

← Back to Home