CVE-2016-5325
Summary
| CVE | CVE-2016-5325 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2016-10-10 16:59:00 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument. |
Risk And Classification
Primary CVSS: v3.0 6.1 MEDIUM from [email protected]
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.009850000 probability, percentile 0.769330000 (date 2026-05-07)
Problem Types: CWE-113 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 6.1 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| 2.0 | [email protected] | Primary | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
ChangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Nodejs | Node.js | 0.10.0 | All | All | All |
| Application | Nodejs | Node.js | 0.10.1 | All | All | All |
| Application | Nodejs | Node.js | 0.10.10 | All | All | All |
| Application | Nodejs | Node.js | 0.10.11 | All | All | All |
| Application | Nodejs | Node.js | 0.10.12 | All | All | All |
| Application | Nodejs | Node.js | 0.10.13 | All | All | All |
| Application | Nodejs | Node.js | 0.10.14 | All | All | All |
| Application | Nodejs | Node.js | 0.10.15 | All | All | All |
| Application | Nodejs | Node.js | 0.10.16 | All | All | All |
| Application | Nodejs | Node.js | 0.10.16-isaacs-manual | All | All | All |
| Application | Nodejs | Node.js | 0.10.17 | All | All | All |
| Application | Nodejs | Node.js | 0.10.18 | All | All | All |
| Application | Nodejs | Node.js | 0.10.19 | All | All | All |
| Application | Nodejs | Node.js | 0.10.2 | All | All | All |
| Application | Nodejs | Node.js | 0.10.20 | All | All | All |
| Application | Nodejs | Node.js | 0.10.21 | All | All | All |
| Application | Nodejs | Node.js | 0.10.22 | All | All | All |
| Application | Nodejs | Node.js | 0.10.23 | All | All | All |
| Application | Nodejs | Node.js | 0.10.24 | All | All | All |
| Application | Nodejs | Node.js | 0.10.25 | All | All | All |
| Application | Nodejs | Node.js | 0.10.26 | All | All | All |
| Application | Nodejs | Node.js | 0.10.27 | All | All | All |
| Application | Nodejs | Node.js | 0.10.28 | All | All | All |
| Application | Nodejs | Node.js | 0.10.29 | All | All | All |
| Application | Nodejs | Node.js | 0.10.3 | All | All | All |
| Application | Nodejs | Node.js | 0.10.30 | All | All | All |
| Application | Nodejs | Node.js | 0.10.31 | All | All | All |
| Application | Nodejs | Node.js | 0.10.32 | All | All | All |
| Application | Nodejs | Node.js | 0.10.33 | All | All | All |
| Application | Nodejs | Node.js | 0.10.34 | All | All | All |
| Application | Nodejs | Node.js | 0.10.35 | All | All | All |
| Application | Nodejs | Node.js | 0.10.36 | All | All | All |
| Application | Nodejs | Node.js | 0.10.37 | All | All | All |
| Application | Nodejs | Node.js | 0.10.38 | All | All | All |
| Application | Nodejs | Node.js | 0.10.39 | All | All | All |
| Application | Nodejs | Node.js | 0.10.4 | All | All | All |
| Application | Nodejs | Node.js | 0.10.40 | All | All | All |
| Application | Nodejs | Node.js | 0.10.41 | All | All | All |
| Application | Nodejs | Node.js | 0.10.42 | All | All | All |
| Application | Nodejs | Node.js | 0.10.43 | All | All | All |
| Application | Nodejs | Node.js | 0.10.44 | All | All | All |
| Application | Nodejs | Node.js | 0.10.45 | All | All | All |
| Application | Nodejs | Node.js | 0.10.46 | All | All | All |
| Application | Nodejs | Node.js | 0.10.5 | All | All | All |
| Application | Nodejs | Node.js | 0.10.6 | All | All | All |
| Application | Nodejs | Node.js | 0.10.7 | All | All | All |
| Application | Nodejs | Node.js | 0.10.8 | All | All | All |
| Application | Nodejs | Node.js | 0.10.9 | All | All | All |
| Application | Nodejs | Node.js | 0.12.0 | All | All | All |
| Application | Nodejs | Node.js | 0.12.1 | All | All | All |
| Application | Nodejs | Node.js | 0.12.10 | All | All | All |
| Application | Nodejs | Node.js | 0.12.11 | All | All | All |
| Application | Nodejs | Node.js | 0.12.12 | All | All | All |
| Application | Nodejs | Node.js | 0.12.13 | All | All | All |
| Application | Nodejs | Node.js | 0.12.14 | All | All | All |
| Application | Nodejs | Node.js | 0.12.15 | All | All | All |
| Application | Nodejs | Node.js | 0.12.2 | All | All | All |
| Application | Nodejs | Node.js | 0.12.3 | All | All | All |
| Application | Nodejs | Node.js | 0.12.4 | All | All | All |
| Application | Nodejs | Node.js | 0.12.5 | All | All | All |
| Application | Nodejs | Node.js | 0.12.6 | All | All | All |
| Application | Nodejs | Node.js | 0.12.7 | All | All | All |
| Application | Nodejs | Node.js | 0.12.8 | All | All | All |
| Application | Nodejs | Node.js | 0.12.9 | All | All | All |
| Application | Nodejs | Node.js | 4.0.0 | All | All | All |
| Application | Nodejs | Node.js | 4.1.0 | All | All | All |
| Application | Nodejs | Node.js | 4.1.1 | All | All | All |
| Application | Nodejs | Node.js | 4.1.2 | All | All | All |
| Application | Nodejs | Node.js | 4.2.0 | All | All | All |
| Application | Nodejs | Node.js | 4.2.1 | All | All | All |
| Application | Nodejs | Node.js | 4.2.2 | All | All | All |
| Application | Nodejs | Node.js | 4.2.3 | All | All | All |
| Application | Nodejs | Node.js | 4.2.4 | All | All | All |
| Application | Nodejs | Node.js | 4.2.5 | All | All | All |
| Application | Nodejs | Node.js | 4.2.6 | All | All | All |
| Application | Nodejs | Node.js | 4.3.0 | All | All | All |
| Application | Nodejs | Node.js | 4.3.1 | All | All | All |
| Application | Nodejs | Node.js | 4.3.2 | All | All | All |
| Application | Nodejs | Node.js | 4.4.0 | All | All | All |
| Application | Nodejs | Node.js | 4.4.1 | All | All | All |
| Application | Nodejs | Node.js | 4.4.2 | All | All | All |
| Application | Nodejs | Node.js | 4.4.3 | All | All | All |
| Application | Nodejs | Node.js | 4.4.4 | All | All | All |
| Application | Nodejs | Node.js | 4.4.5 | All | All | All |
| Application | Nodejs | Node.js | 4.4.6 | All | All | All |
| Application | Nodejs | Node.js | 4.4.7 | All | All | All |
| Application | Nodejs | Node.js | 4.5.0 | All | All | All |
| Application | Nodejs | Node.js | 6.0.0 | All | All | All |
| Application | Nodejs | Node.js | 6.1.0 | All | All | All |
| Application | Nodejs | Node.js | 6.2.0 | All | All | All |
| Application | Nodejs | Node.js | 6.2.1 | All | All | All |
| Application | Nodejs | Node.js | 6.2.2 | All | All | All |
| Application | Nodejs | Node.js | 6.3.0 | All | All | All |
| Application | Nodejs | Node.js | 6.3.1 | All | All | All |
| Application | Nodejs | Node.js | 6.4.0 | All | All | All |
| Application | Nodejs | Node.js | 6.5.0 | All | All | All |
| Application | Nodejs | Node.js | 6.6.0 | All | All | All |
| Operating System | Suse | Linux Enterprise | 12.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Node.js: Multiple vulnerabilities (GLSA 201612-43) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| Node.js CVE-2016-5325 CRLF Injection Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Security updates for all active release lines, September 2016 | Node.js | af854a3a-2127-422b-91ae-364da2661108 | nodejs.org | Patch, Vendor Advisory |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| [security-announce] SUSE-SU-2016:2470-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Third Party Advisory |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| http: check reason chars in writeHead · nodejs/node@c0f13e5 · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Issue Tracking, Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.