The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x bef…

published 2016-04-07 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-3300

cvss: 7.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 7.3%; EPSS 7.3% chance of exploitation in 30 days, percentile 94%
public exploits: 0; none known

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

Patch / fix

distros 2 links 1

debian suse

nodejs Debian 14, Debian 13, Debian 12 4.3.0~dfsg-1

debian advisories DEBIAN-CVE-2016-2216

firefox-atk SLES 11 SP4-LTSS 2.26.1-2.8.4
mozilla-nss SLES 11 SP4-LTSS 3.45-38.9.3
firefox-gtk3 SLES 11 SP4-LTSS 3.10.9-2.15.3
mozilla-nspr SLES 11 SP4-LTSS 4.21-29.6.1
firefox-cairo SLES 11 SP4-LTSS 1.15.10-2.13.4
firefox-glib2 SLES 11 SP4-LTSS 2.54.3-2.14.7
firefox-pango SLES 11 SP4-LTSS 1.40.14-2.7.4
firefox-libffi SLES 11 SP4-LTSS 3.2.1.git259-2.3.3

suse advisories SUSE-SU-2019:14246-1

nodejs.org/en/blog/vulnerability/february-2016-security-releases/ advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-2216 updated 2026-06-27 cvss 4.3

nodejs: Response splitting vulnerability using Unicode characters

Red Hat OpenShift Enterprise 2 nodejs010-nodejs Red Hat Software Collections nodejs010-nodejs
affected: no fix planned “Will not fix”
Red Hat OpenShift Enterprise 3 nodejs Red Hat Software Collections rh-nodejs4-nodejs
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

7.26% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-20 Improper Input Validation

Technology feeds

Node.js rss critical rss

References

nodejs.org /en/blog/vulnerability/february-2016-security-releases/
patch, vendor-advisory
lists.fedoraproject.org /pipermail/package-announce/2016-February/177673.html
vendor-advisory
lists.fedoraproject.org /pipermail/package-announce/2016-February/177184.html
vendor-advisory
security.gentoo.org /glsa/201612-43
vendor-advisory
blog.safebreach.com /2016/02/09/http-response-splitting-in-node-js-root-cause-analysis/
packetstormsecurity.com /files/135711/Node.js-HTTP-Response-Splitting.html
securityfocus.com /bid/83141
vdb-entry
info.safebreach.com /hubfs/Node-js-Response-Splitting.pdf

Sources

CVE List CVE-2016-2216
NVD CVE-2016-2216

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary