What’s Vulnerable › Vulnerabilities

CVE-2017-16005

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-04 · updated 2026-06-17
• Weakness: CWE-20

Description

Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.

Affected products

• HackerOne http-signature node module: through 0.9.11

References

• https://github.com/joyent/node-http-signature/issues/10
• https://nodesecurity.io/advisories/318
• https://github.com/joyent/node-http-signature/issues/10
• https://nodesecurity.io/advisories/318

Get alerted when CVE-2017-16005 or the next vulnerability affects your stack