Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ Patch, Vendor Advisory
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · nodejs, suseNVD modified 2026-10-08 22:16
Affected (CPE criteria) 7
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*cpe:2.3:a:suse:suse_enterprise_storage:4:*:*:*:*:*:*:*cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*cpe:2.3:o:suse:suse_linux_enterprise_server:15:*:*:*:*:*:*:*cpe:2.3:o:suse:suse_openstack_cloud:7:*:*:*:*:*:*:*cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
References 6
- https://access.redhat.com/errata/RHSA-2019:1821 Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202003-48 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1821 Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202003-48 Third Party Advisory