Skip to content
OpenAdvisories
Medium RHSA-2016:2101 2 CVEs

Red Hat Security Advisory: nodejs and nodejs-tough-cookie security, bug fix, and enhancement update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · OpenShift 3 openshift:3.1::el7 nodejs 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.1::el7 nodejs-debuginfo 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.1::el7 nodejs-devel 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.1::el7 nodejs-docs 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.1::el7 nodejs-tough-cookie 0:2.3.1-1.el7
Red Hat · OpenShift 3 openshift:3.2::el7 nodejs 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.2::el7 nodejs-debuginfo 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.2::el7 nodejs-devel 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.2::el7 nodejs-docs 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.2::el7 nodejs-tough-cookie 0:2.3.1-1.el7
Red Hat · OpenShift 3 openshift:3.3::el7 nodejs 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.3::el7 nodejs-debuginfo 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.3::el7 nodejs-devel 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.3::el7 nodejs-docs 0:0.10.47-2.el7
Red Hat · OpenShift 3 openshift:3.3::el7 nodejs-tough-cookie 0:2.3.1-1.el7

Vulnerabilities 2

  • Medium 5.3
    CVE-2016-1000232

    ReDoS via long string of semicolons in tough-cookie

    NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability …

    tough-cookie npm
  • Unscored —
    CVE-2016-5325

    CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0…

    nodejs nodejs Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1346910
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1359818
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1382854
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2101.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-5325
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-5325
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-5325
  • article
    https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2016-1000232
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1000232
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1000232
  • article
    https://nodesecurity.io/advisories/130