CVE-2018-12116

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 6.15.0 Node.js versions prior to 8.14.0

Description The issue is related to HTTP request splitting, where Node.js can be tricked into using unsanitized user-provided Unicode data for the path option of an HTTP request. This can lead to a second, unexpected HTTP request being made to the same server. The vulnerability is also associated with errors in handling HTTP packets, which can allow a remote attacker to gain unauthorized access to protected data using HTTP requests.

Recommendations For versions prior to 6.15.0, update to version 6.15.0 or later. For versions prior to 8.14.0, update to version 8.14.0 or later.