What’s Vulnerable › Vulnerabilities

CVE-2016-2086

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-04-07 · updated 2026-06-17
• Weakness: CWE-20

Description

Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

Affected products

• Fedoraproject Fedora: 22, 23
• Node.js: 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5 (+66)

References

• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html
• http://www.securityfocus.com/bid/83282
• https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/
• https://security.gentoo.org/glsa/201612-43
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177184.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177673.html
• http://www.securityfocus.com/bid/83282
• https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/
• https://security.gentoo.org/glsa/201612-43

Get alerted when CVE-2016-2086 or the next vulnerability affects your stack