Description
CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nodejs | 4.6.0~dfsg-1 | — |
| Debian 13 | nodejs | 4.6.0~dfsg-1 | — |
| Debian 12 | nodejs | 4.6.0~dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | nodejs | 4.2.6~dfsg-1ubuntu4.2 | — |
| Ubuntu 14.04 LTS | nodejs | 0.10.25~dfsg2-2ubuntu1.2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 2 | rh-nodejs4-http-parser +1 | 2.7.0-2.el6 | RHSA-2017:0002 |
| RHEL 2 | rh-nodejs4-nodejs +2 | 4.6.2-4.el6 | RHSA-2017:0002 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | nodejs +2 | 0.10.47-2.el7 | RHSA-2016:2101 |
| Red Hat OpenShift 3 | nodejs-tough-cookie | 2.3.1-1.el7 | RHSA-2016:2101 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | nodejs4 | 4.6.0-8.1 | SUSE-SU-2016:2470-2, SUSE-SU-2016:2470-1 |
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
Advisories 6
- WID-SEC-2026-3114 Red Hat Enterprise Linux Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- RHSA-2017:0002 Red Hat Security Advisory: rh-nodejs4-nodejs and rh-nodejs4-http-parser security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2101 Red Hat Security Advisory: nodejs and nodejs-tough-cookie security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- SUSE-SU-2016:2470-1 Security update for nodejs4 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2470-2 Security update for nodejs4 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762
- RHSA-2016:2101 vendor-advisory
- https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
- 93483 vdb-entry
- GLSA-201612-43 vendor-advisory
- RHSA-2017:0002 vendor-advisory
- SUSE-SU-2016:2470 vendor-advisory