Skip to content
OpenAdvisories

Product · HackerOne

http-signature node module

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2017-16005

    Header Forgery in http-signature

    Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can int…

    HackerOne http-signature node module http-signature npm