{"id":"CVE-2016-5325","aliases":["DEBIAN-CVE-2016-5325","EUVD-2016-6276","GHSA-qpf8-fqrf-8p2h","MGASA-2017-0204","RHSA-2016:2101","RHSA-2017:0002","SUSE-SU-2016:2470-1","SUSE-SU-2016:2470-2","SUSE-SU-2019:14246-1","UBUNTU-CVE-2016-5325","openSUSE-SU-2024:10247-1"],"status":"published","title":"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0...","description":"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04093,"percentile":0.90805,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-113"],"published":"2016-10-06T14:39:43Z","modified":"2026-10-24T10:47:34Z","fixes":[{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["4.6.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["4.6.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["4.6.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nodejs","fixed_in":["0.10.25~dfsg2-2ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"nodejs","fixed_in":["4.2.6~dfsg-1ubuntu4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.48-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.1::el7","package":"nodejs-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.1-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.2::el7","package":"nodejs-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.1-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.3::el7","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.3::el7","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.3::el7","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.3::el7","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.47-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.3::el7","package":"nodejs-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.1-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-http-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-http-parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-http-parser-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-http-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-http-parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-http-parser-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-4.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-8.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-8.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.2.0-78.51.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68-21.9.8"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-atk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-2.8.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2.13.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.11-2.8.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-2.14.7"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.9-2.15.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-harfbuzz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2.7.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1.git259-2.3.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-libffi-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-14.1"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-pango","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.14-2.7.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21-29.6.1"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45-38.9.3"}]}],"bundled":118},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.25~dfsg2-2ubuntu1.2"}]}],"versions":["0.10.15~dfsg1-4","0.10.21~dfsg1-1","0.10.22~dfsg1-2","0.10.23~dfsg1-1","0.10.23~dfsg1-2","0.10.23~dfsg1-3","0.10.24~dfsg1-1","0.10.25~dfsg2-2","0.10.25~dfsg2-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6~dfsg-1ubuntu4.2"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1"]}],"products":[{"vendor":"nodejs","product":"node.js"},{"vendor":"suse","product":"linux_enterprise"}],"references":[{"url":"https://github.com/nodejs/node/commit/c0f13e56a20f9bde5a67d873a7f9564487160762","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2101","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web","article"]},{"url":"http://www.securityfocus.com/bid/93483","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201612-43","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0002.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5325","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2016-security-releases"},{"url":"https://github.com/advisories/GHSA-qpf8-fqrf-8p2h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-5325","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0204.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19550","tags":["report"]},{"url":"https://nodejs.org/en/blog/release/v0.10.47/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v0.10.48/","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1346910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1382854","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2101.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5325","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1000232","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1000232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000232","tags":["advisory"]},{"url":"https://nodesecurity.io/advisories/130","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0002","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1379921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1380463","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388097","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0002.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1669","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1669","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1669","tags":["advisory"]},{"url":"http://googlechromereleases.blogspot.com/2016/05/stable-channel-update.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5180","tags":["advisory"]},{"url":"https://c-ares.haxx.se/adv_20160929.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7099","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162470-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1001652","tags":["report"]},{"url":"https://bugzilla.suse.com/985201","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7099","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162470-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914246-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000036","tags":["report"]},{"url":"https://bugzilla.suse.com/1025108","tags":["report"]},{"url":"https://bugzilla.suse.com/1029377","tags":["report"]},{"url":"https://bugzilla.suse.com/1029902","tags":["report"]},{"url":"https://bugzilla.suse.com/1040164","tags":["report"]},{"url":"https://bugzilla.suse.com/104105","tags":["report"]},{"url":"https://bugzilla.suse.com/1042670","tags":["report"]},{"url":"https://bugzilla.suse.com/1043008","tags":["report"]},{"url":"https://bugzilla.suse.com/1044946","tags":["report"]},{"url":"https://bugzilla.suse.com/1047925","tags":["report"]},{"url":"https://bugzilla.suse.com/1047936","tags":["report"]},{"url":"https://bugzilla.suse.com/1048299","tags":["report"]},{"url":"https://bugzilla.suse.com/1049186","tags":["report"]},{"url":"https://bugzilla.suse.com/1050653","tags":["report"]},{"url":"https://bugzilla.suse.com/1056058","tags":["report"]},{"url":"https://bugzilla.suse.com/1058013","tags":["report"]},{"url":"https://bugzilla.suse.com/1066242","tags":["report"]},{"url":"https://bugzilla.suse.com/1066953","tags":["report"]},{"url":"https://bugzilla.suse.com/1070738","tags":["report"]},{"url":"https://bugzilla.suse.com/1070853","tags":["report"]},{"url":"https://bugzilla.suse.com/1072320","tags":["report"]},{"url":"https://bugzilla.suse.com/1072322","tags":["report"]},{"url":"https://bugzilla.suse.com/1073796","tags":["report"]},{"url":"https://bugzilla.suse.com/1073798","tags":["report"]},{"url":"https://bugzilla.suse.com/1073799","tags":["report"]},{"url":"https://bugzilla.suse.com/1073803","tags":["report"]},{"url":"https://bugzilla.suse.com/1073808","tags":["report"]},{"url":"https://bugzilla.suse.com/1073818","tags":["report"]},{"url":"https://bugzilla.suse.com/1073823","tags":["report"]},{"url":"https://bugzilla.suse.com/1073829","tags":["report"]},{"url":"https://bugzilla.suse.com/1073830","tags":["report"]},{"url":"https://bugzilla.suse.com/1073832","tags":["report"]},{"url":"https://bugzilla.suse.com/1073846","tags":["report"]},{"url":"https://bugzilla.suse.com/1074235","tags":["report"]},{"url":"https://bugzilla.suse.com/1077230","tags":["report"]},{"url":"https://bugzilla.suse.com/1079761","tags":["report"]},{"url":"https://bugzilla.suse.com/1081750","tags":["report"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1087453","tags":["report"]},{"url":"https://bugzilla.suse.com/1087459","tags":["report"]},{"url":"https://bugzilla.suse.com/1087463","tags":["report"]},{"url":"https://bugzilla.suse.com/1088573","tags":["report"]},{"url":"https://bugzilla.suse.com/1091764","tags":["report"]},{"url":"https://bugzilla.suse.com/1094814","tags":["report"]},{"url":"https://bugzilla.suse.com/1097158","tags":["report"]},{"url":"https://bugzilla.suse.com/1097375","tags":["report"]},{"url":"https://bugzilla.suse.com/1097401","tags":["report"]},{"url":"https://bugzilla.suse.com/1097404","tags":["report"]},{"url":"https://bugzilla.suse.com/1097748","tags":["report"]},{"url":"https://bugzilla.suse.com/1104841","tags":["report"]},{"url":"https://bugzilla.suse.com/1105019","tags":["report"]},{"url":"https://bugzilla.suse.com/1107030","tags":["report"]},{"url":"https://bugzilla.suse.com/1109465","tags":["report"]},{"url":"https://bugzilla.suse.com/1117473","tags":["report"]},{"url":"https://bugzilla.suse.com/1117626","tags":["report"]},{"url":"https://bugzilla.suse.com/1117627","tags":["report"]},{"url":"https://bugzilla.suse.com/1117629","tags":["report"]},{"url":"https://bugzilla.suse.com/1117630","tags":["report"]},{"url":"https://bugzilla.suse.com/1120644","tags":["report"]},{"url":"https://bugzilla.suse.com/1122191","tags":["report"]},{"url":"https://bugzilla.suse.com/1123482","tags":["report"]},{"url":"https://bugzilla.suse.com/1124525","tags":["report"]},{"url":"https://bugzilla.suse.com/1127532","tags":["report"]},{"url":"https://bugzilla.suse.com/1129346","tags":["report"]},{"url":"https://bugzilla.suse.com/1130694","tags":["report"]},{"url":"https://bugzilla.suse.com/1130840","tags":["report"]},{"url":"https://bugzilla.suse.com/1133452","tags":["report"]},{"url":"https://bugzilla.suse.com/1133810","tags":["report"]},{"url":"https://bugzilla.suse.com/1134209","tags":["report"]},{"url":"https://bugzilla.suse.com/1138459","tags":["report"]},{"url":"https://bugzilla.suse.com/1140290","tags":["report"]},{"url":"https://bugzilla.suse.com/1140868","tags":["report"]},{"url":"https://bugzilla.suse.com/1141853","tags":["report"]},{"url":"https://bugzilla.suse.com/1144919","tags":["report"]},{"url":"https://bugzilla.suse.com/1145665","tags":["report"]},{"url":"https://bugzilla.suse.com/1146090","tags":["report"]},{"url":"https://bugzilla.suse.com/1146091","tags":["report"]},{"url":"https://bugzilla.suse.com/1146093","tags":["report"]},{"url":"https://bugzilla.suse.com/1146094","tags":["report"]},{"url":"https://bugzilla.suse.com/1146095","tags":["report"]},{"url":"https://bugzilla.suse.com/1146097","tags":["report"]},{"url":"https://bugzilla.suse.com/1146099","tags":["report"]},{"url":"https://bugzilla.suse.com/1146100","tags":["report"]},{"url":"https://bugzilla.suse.com/1149323","tags":["report"]},{"url":"https://bugzilla.suse.com/1153423","tags":["report"]},{"url":"https://bugzilla.suse.com/1154738","tags":["report"]},{"url":"https://bugzilla.suse.com/1447070","tags":["report"]},{"url":"https://bugzilla.suse.com/1447409","tags":["report"]},{"url":"https://bugzilla.suse.com/744625","tags":["report"]},{"url":"https://bugzilla.suse.com/744629","tags":["report"]},{"url":"https://bugzilla.suse.com/845955","tags":["report"]},{"url":"https://bugzilla.suse.com/865853","tags":["report"]},{"url":"https://bugzilla.suse.com/905528","tags":["report"]},{"url":"https://bugzilla.suse.com/917607","tags":["report"]},{"url":"https://bugzilla.suse.com/935856","tags":["report"]},{"url":"https://bugzilla.suse.com/937414","tags":["report"]},{"url":"https://bugzilla.suse.com/947747","tags":["report"]},{"url":"https://bugzilla.suse.com/948045","tags":["report"]},{"url":"https://bugzilla.suse.com/948602","tags":["report"]},{"url":"https://bugzilla.suse.com/955142","tags":["report"]},{"url":"https://bugzilla.suse.com/957814","tags":["report"]},{"url":"https://bugzilla.suse.com/957815","tags":["report"]},{"url":"https://bugzilla.suse.com/961254","tags":["report"]},{"url":"https://bugzilla.suse.com/962297","tags":["report"]},{"url":"https://bugzilla.suse.com/966076","tags":["report"]},{"url":"https://bugzilla.suse.com/966077","tags":["report"]},{"url":"https://bugzilla.suse.com/986541","tags":["report"]},{"url":"https://bugzilla.suse.com/991344","tags":["report"]},{"url":"https://bugzilla.suse.com/998743","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9947","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-5325","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5180","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-5325","description":"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.","status":"published","published":"2016-10-10T16:00:00Z","modified":"2024-08-06T01:00:59.867Z","updated_at":"2026-11-02T14:33:30.767029Z"}],"euvd":[{"id":"EUVD-2016-6276","description":"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.","status":"published","published":"2016-10-10T16:00:00Z","modified":"2024-08-06T01:00:59Z","updated_at":"2026-11-03T02:22:42.442421Z"}],"ghsa":[{"id":"GHSA-qpf8-fqrf-8p2h","title":"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0...","description":"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.","status":"published","published":"2022-05-14T03:56:33Z","modified":"2025-04-12T13:05:21Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-113"],"updated_at":"2026-11-02T15:01:29.780856Z"}],"nvd":[{"id":"CVE-2016-5325","description":"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.","status":"published","published":"2016-10-10T16:59:00.2Z","modified":"2026-06-17T00:49:13.1Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-113"],"updated_at":"2026-11-02T14:03:31.485755Z"}],"osv":[{"id":"CVE-2016-5325","description":"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.","status":"published","published":"2016-10-10T16:59:00.2Z","modified":"2026-10-24T10:47:34.331207682Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-5325","description":"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.","status":"published","published":"2016-10-10T16:59:00.2Z","modified":"2026-09-22T07:02:00.590707867Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"RHSA-2016:2101","title":"Red Hat Security Advisory: nodejs and nodejs-tough-cookie security, bug fix, and enhancement update","status":"published","published":"2024-09-13T12:28:08Z","modified":"2026-06-29T10:14:08Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2017:0002","title":"Red Hat Security Advisory: rh-nodejs4-nodejs and rh-nodejs4-http-parser security update","status":"published","published":"2024-09-13T14:37:29Z","modified":"2026-06-29T10:14:45Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2016-5325","description":"CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.","status":"published","published":"2016-10-10T16:59:00Z","modified":"2026-04-22T10:51:29.764361Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"MGASA-2017-0204","title":"Updated nodejs packages fix security vulnerability","description":"Node.js has a defect that may make HTTP response splitting possible\nunder certain circumstances. If user-input is passed to the reason\nargument to writeHead() on an HTTP response, a new-line character may be\nused to inject additional responses (CVE-2016-5325).\n\nThe tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47 does\nnot properly handle wildcards in name fields of X.509 certificates, which\nallows man-in-the-middle attackers to spoof servers via a crafted\ncertificate (CVE-2016-7099).\n","status":"published","published":"2017-07-13T09:10:46Z","modified":"2026-04-16T06:23:04.675525188Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10247-1","title":"nodejs4-4.7.0-1.1 on GA media","description":"These are all security issues fixed in the nodejs4-4.7.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:23:14.43884Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2470-1","title":"Security update for nodejs4","description":"\nThis update brings the new upstream nodejs LTS version 4.6.0, fixing bugs\nand security issues:\n\n* Nodejs embedded openssl version update\n    + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183, CVE-2016-2178,\n      CVE-2016-6306, CVE-2016-7052)\n    + remove support for dynamic 3rd party engine modules\n* http: Properly validate for allowable characters in input\n  user data. This introduces a new case where throw may occur\n  when configuring HTTP responses, users should already\n  be adopting try/catch here. (CVE-2016-5325, bsc#985201)\n* tls: properly validate wildcard certificates\n  (CVE-2016-7099, bsc#1001652)\n* buffer: Zero-fill excess bytes in new Buffer objects created\n  with Buffer.concat()\n","status":"published","published":"2016-10-06T14:39:43Z","modified":"2026-02-04T03:00:59.034787Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2470-2","title":"Security update for nodejs4","description":"\nThis update brings the new upstream nodejs LTS version 4.6.0, fixing bugs\nand security issues:\n\n* Nodejs embedded openssl version update\n    + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183, CVE-2016-2178,\n      CVE-2016-6306, CVE-2016-7052)\n    + remove support for dynamic 3rd party engine modules\n* http: Properly validate for allowable characters in input\n  user data. This introduces a new case where throw may occur\n  when configuring HTTP responses, users should already\n  be adopting try/catch here. (CVE-2016-5325, bsc#985201)\n* tls: properly validate wildcard certificates\n  (CVE-2016-7099, bsc#1001652)\n* buffer: Zero-fill excess bytes in new Buffer objects created\n  with Buffer.concat()\n","status":"published","published":"2016-10-06T14:39:43Z","modified":"2026-02-04T02:33:34.641396Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2019:14246-1","title":"Security update for Mozilla Firefox","description":"\nThis update contains the Mozilla Firefox ESR 68.2 release.\n\nMozilla Firefox was updated to ESR 68.2 release:\n\n* Enterprise: New administrative policies were added. More\n  information and templates are available at the Policy\n  Templates page.\n\n* Various security fixes:\n  MFSA 2019-33 (bsc#1154738)\n  * CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber\n  * CVE-2019-11757: Use-after-free when creating index updates in IndexedDB\n  * CVE-2019-11758: Potentially exploitable crash due to 360 Total Security\n  * CVE-2019-11759: Stack buffer overflow in HKDF output\n  * CVE-2019-11760: Stack buffer overflow in WebRTC networking\n  * CVE-2019-11761: Unintended access to a privileged JSONView object\n  * CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation\n  * CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique\n  * CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2\n\nOther Issues resolved:\n\n* [bsc#1104841] Newer versions of firefox have a dependency on\n                GLIBCXX_3.4.20\n* [bsc#1074235] MozillaFirefox: background tab crash reports sent\n                inadvertently without user opt-in\n* [bsc#1043008] Firefox hangs randomly when browsing and\n                scrolling\n* [bsc#1025108] Firefox stops loading page until mouse is moved\n* [bsc#905528]  Firefox malfunctions due to broken omni.ja\n                archives\n\n","status":"published","published":"2020-01-17T17:07:38Z","modified":"2026-02-04T02:31:26.178072Z","updated_at":"2026-11-02T15:53:46.44301Z"}]}}