CVE-2018-12116 is a high-severity HTTP request splitting vulnerability affecting Node.js versions prior to 6.15.0 and 8.14.0, as well as various SUSE products utilizing Node.js. An attacker can exploit this by injecting unsanitized Unicode data into the path option of an HTTP request, tricking Node.js into making an additional, attacker-controlled request to the same server. With a CVSS score of 7.5, this vulnerability is network-exploitable with low attack complexity, potentially leading to high integrity impacts. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.0.0, <= 6.8.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 6.9.0, < 6.15.0CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | ||
>= 8.0.0, <= 8.8.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 8.9.0, < 8.14.0CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | ||
4CPE matchmatch criteria | cpe:2.3:a:suse:suse_enterprise_storage:4:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
nodejs: HTTP request splitting
Nov 27, 2018Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request then data can be provided which will trigger a second unexpected and user-defined HTTP request to made to the same server.
Nov 13, 2018