Read the docs
TI-2016-03362 Aliases CVE-2016-3956GHSA-m5h6-hr3q-22h5

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before…

Priority MEDIUM 41CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.

Why it matters now

EPSS 0.05456 92nd percentileScored 2026-11-07
Fix Partial npm (npm): 2.15.1, 3.8.3Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—npm (npm)before 2.15.12.15.1Patch availableGHSA-m5h6-hr3q-22h5
—npm (npm)3.0.0 to before 3.8.33.8.3Patch availableGHSA-m5h6-hr3q-22h5
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • npm (npm) Vendor— Affected before 2.15.1 Fixed in 2.15.1 Patch available GHSA-m5h6-hr3q-22h5
  • npm (npm) Vendor— Affected 3.0.0 to before 3.8.3 Fixed in 3.8.3 Patch available GHSA-m5h6-hr3q-22h5

CPE configurations NVD · 92

CPEVersionsRoleVendor
cpe:2.3:a:ibm:sdk:*:*:*:*:*:nodejs:*:*up to 1.1.0.20; up to 1.2.0.10; up to 4.4.1.0VulnerableIBM
cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:*0.10.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.1:*:*:*:*:*:*:*0.10.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.2:*:*:*:*:*:*:*0.10.2VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.3:*:*:*:*:*:*:*0.10.3VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.4:*:*:*:*:*:*:*0.10.4VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.5:*:*:*:*:*:*:*0.10.5VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.6:*:*:*:*:*:*:*0.10.6VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.7:*:*:*:*:*:*:*0.10.7VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.8:*:*:*:*:*:*:*0.10.8VulnerableNodeJS
  • cpe:2.3:a:ibm:sdk:*:*:*:*:*:nodejs:*:* Versions up to 1.1.0.20; up to 1.2.0.10; up to 4.4.1.0 Vulnerable ·IBM
  • cpe:2.3:a:nodejs:node.js:0.10.0:*:*:*:*:*:*:* Versions 0.10.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.1:*:*:*:*:*:*:* Versions 0.10.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.2:*:*:*:*:*:*:* Versions 0.10.2 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.3:*:*:*:*:*:*:* Versions 0.10.3 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.4:*:*:*:*:*:*:* Versions 0.10.4 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.5:*:*:*:*:*:*:* Versions 0.10.5 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.6:*:*:*:*:*:*:* Versions 0.10.6 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.7:*:*:*:*:*:*:* Versions 0.10.7 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.8:*:*:*:*:*:*:* Versions 0.10.8 Vulnerable ·NodeJS
Show 82 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:nodejs:node.js:0.10.9:*:*:*:*:*:*:*0.10.9VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.10:*:*:*:*:*:*:*0.10.10VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.11:*:*:*:*:*:*:*0.10.11VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.12:*:*:*:*:*:*:*0.10.12VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.13:*:*:*:*:*:*:*0.10.13VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.14:*:*:*:*:*:*:*0.10.14VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.15:*:*:*:*:*:*:*0.10.15VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.16:*:*:*:*:*:*:*0.10.16VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.16-isaacs-manual:*:*:*:*:*:*:*0.10.16-isaacs-manualVulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.17:*:*:*:*:*:*:*0.10.17VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.18:*:*:*:*:*:*:*0.10.18VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.19:*:*:*:*:*:*:*0.10.19VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.20:*:*:*:*:*:*:*0.10.20VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.21:*:*:*:*:*:*:*0.10.21VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.22:*:*:*:*:*:*:*0.10.22VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.23:*:*:*:*:*:*:*0.10.23VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.24:*:*:*:*:*:*:*0.10.24VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.25:*:*:*:*:*:*:*0.10.25VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.26:*:*:*:*:*:*:*0.10.26VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.27:*:*:*:*:*:*:*0.10.27VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.28:*:*:*:*:*:*:*0.10.28VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.29:*:*:*:*:*:*:*0.10.29VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.30:*:*:*:*:*:*:*0.10.30VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.31:*:*:*:*:*:*:*0.10.31VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.32:*:*:*:*:*:*:*0.10.32VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.33:*:*:*:*:*:*:*0.10.33VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.34:*:*:*:*:*:*:*0.10.34VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.35:*:*:*:*:*:*:*0.10.35VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.36:*:*:*:*:*:*:*0.10.36VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.37:*:*:*:*:*:*:*0.10.37VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.38:*:*:*:*:*:*:*0.10.38VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.39:*:*:*:*:*:*:*0.10.39VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.40:*:*:*:*:*:*:*0.10.40VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.10.41:*:*:*:*:*:*:*0.10.41VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.12.0:*:*:*:*:*:*:*0.12.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.12.1:*:*:*:*:*:*:*0.12.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.12.2:*:*:*:*:*:*:*0.12.2VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.12.3:*:*:*:*:*:*:*0.12.3VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.12.4:*:*:*:*:*:*:*0.12.4VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.12.5:*:*:*:*:*:*:*0.12.5VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.12.6:*:*:*:*:*:*:*0.12.6VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.12.7:*:*:*:*:*:*:*0.12.7VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.12.8:*:*:*:*:*:*:*0.12.8VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:0.12.9:*:*:*:*:*:*:*0.12.9VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.2.2:*:*:*:*:*:*:*4.2.2VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.2.3:*:*:*:*:*:*:*4.2.3VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.2.4:*:*:*:*:*:*:*4.2.4VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.2.5:*:*:*:*:*:*:*4.2.5VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.2.6:*:*:*:*:*:*:*4.2.6VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.3.1:*:*:*:*:*:*:*4.3.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.3.1:rc.1:*:*:*:*:*:*4.3.1 rc.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.3.1:rc.2:*:*:*:*:*:*4.3.1 rc.2VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.3.2:*:*:*:*:*:*:*4.3.2VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.4.0:*:*:*:*:*:*:*4.4.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.4.0:rc.1:*:*:*:*:*:*4.4.0 rc.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.4.0:rc.2:*:*:*:*:*:*4.4.0 rc.2VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.4.0:rc.3:*:*:*:*:*:*4.4.0 rc.3VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.4.0:rc.4:*:*:*:*:*:*4.4.0 rc.4VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:4.4.1:*:*:*:*:*:*:*4.4.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.1.0:*:*:*:*:*:*:*5.1.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.1.1:*:*:*:*:*:*:*5.1.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.3.0:*:*:*:*:*:*:*5.3.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.4.0:*:*:*:*:*:*:*5.4.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.4.1:*:*:*:*:*:*:*5.4.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.6.0:*:*:*:*:*:*:*5.6.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.7.0:*:*:*:*:*:*:*5.7.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.7.1:*:*:*:*:*:*:*5.7.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.8.0:*:*:*:*:*:*:*5.8.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.8.1:rc.1:*:*:*:*:*:*5.8.1 rc.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.9.0:*:*:*:*:*:*:*5.9.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:5.9.1:*:*:*:*:*:*:*5.9.1VulnerableNodeJS
cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:*before 2.15.1; 3.0.0 to before 3.8.3VulnerableNpmjs
  • cpe:2.3:a:nodejs:node.js:0.10.9:*:*:*:*:*:*:* Versions 0.10.9 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.10:*:*:*:*:*:*:* Versions 0.10.10 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.11:*:*:*:*:*:*:* Versions 0.10.11 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.12:*:*:*:*:*:*:* Versions 0.10.12 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.13:*:*:*:*:*:*:* Versions 0.10.13 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.14:*:*:*:*:*:*:* Versions 0.10.14 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.15:*:*:*:*:*:*:* Versions 0.10.15 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.16:*:*:*:*:*:*:* Versions 0.10.16 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.16-isaacs-manual:*:*:*:*:*:*:* Versions 0.10.16-isaacs-manual Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.17:*:*:*:*:*:*:* Versions 0.10.17 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.18:*:*:*:*:*:*:* Versions 0.10.18 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.19:*:*:*:*:*:*:* Versions 0.10.19 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.20:*:*:*:*:*:*:* Versions 0.10.20 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.21:*:*:*:*:*:*:* Versions 0.10.21 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.22:*:*:*:*:*:*:* Versions 0.10.22 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.23:*:*:*:*:*:*:* Versions 0.10.23 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.24:*:*:*:*:*:*:* Versions 0.10.24 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.25:*:*:*:*:*:*:* Versions 0.10.25 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.26:*:*:*:*:*:*:* Versions 0.10.26 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.27:*:*:*:*:*:*:* Versions 0.10.27 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.28:*:*:*:*:*:*:* Versions 0.10.28 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.29:*:*:*:*:*:*:* Versions 0.10.29 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.30:*:*:*:*:*:*:* Versions 0.10.30 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.31:*:*:*:*:*:*:* Versions 0.10.31 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.32:*:*:*:*:*:*:* Versions 0.10.32 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.33:*:*:*:*:*:*:* Versions 0.10.33 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.34:*:*:*:*:*:*:* Versions 0.10.34 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.35:*:*:*:*:*:*:* Versions 0.10.35 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.36:*:*:*:*:*:*:* Versions 0.10.36 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.37:*:*:*:*:*:*:* Versions 0.10.37 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.38:*:*:*:*:*:*:* Versions 0.10.38 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.39:*:*:*:*:*:*:* Versions 0.10.39 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.40:*:*:*:*:*:*:* Versions 0.10.40 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.10.41:*:*:*:*:*:*:* Versions 0.10.41 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.12.0:*:*:*:*:*:*:* Versions 0.12.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.12.1:*:*:*:*:*:*:* Versions 0.12.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.12.2:*:*:*:*:*:*:* Versions 0.12.2 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.12.3:*:*:*:*:*:*:* Versions 0.12.3 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.12.4:*:*:*:*:*:*:* Versions 0.12.4 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.12.5:*:*:*:*:*:*:* Versions 0.12.5 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.12.6:*:*:*:*:*:*:* Versions 0.12.6 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.12.7:*:*:*:*:*:*:* Versions 0.12.7 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.12.8:*:*:*:*:*:*:* Versions 0.12.8 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:0.12.9:*:*:*:*:*:*:* Versions 0.12.9 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.2.5:*:*:*:*:*:*:* Versions 4.2.5 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.2.6:*:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.3.1:rc.1:*:*:*:*:*:* Versions 4.3.1 rc.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.3.1:rc.2:*:*:*:*:*:* Versions 4.3.1 rc.2 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.3.2:*:*:*:*:*:*:* Versions 4.3.2 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.4.0:*:*:*:*:*:*:* Versions 4.4.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.4.0:rc.1:*:*:*:*:*:* Versions 4.4.0 rc.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.4.0:rc.2:*:*:*:*:*:* Versions 4.4.0 rc.2 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.4.0:rc.3:*:*:*:*:*:* Versions 4.4.0 rc.3 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.4.0:rc.4:*:*:*:*:*:* Versions 4.4.0 rc.4 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:4.4.1:*:*:*:*:*:*:* Versions 4.4.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.4.0:*:*:*:*:*:*:* Versions 5.4.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.4.1:*:*:*:*:*:*:* Versions 5.4.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.7.0:*:*:*:*:*:*:* Versions 5.7.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.7.1:*:*:*:*:*:*:* Versions 5.7.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.8.0:*:*:*:*:*:*:* Versions 5.8.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.8.1:rc.1:*:*:*:*:*:* Versions 5.8.1 rc.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.9.0:*:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:5.9.1:*:*:*:*:*:*:* Versions 5.9.1 Vulnerable ·NodeJS
  • cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:* Versions before 2.15.1; 3.0.0 to before 3.8.3 Vulnerable ·Npmjs

Remediation

  • Fix · GHSA-m5h6-hr3q-22h5 npm (npm) Fixed in 2.15.1 Advisory →
  • Fix · GHSA-m5h6-hr3q-22h5 npm (npm) Fixed in 3.8.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Not affected: 1 product
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-3956
  2. 2026-10-03 Alias added: GHSA-m5h6-hr3q-22h5

References

Patch 2

Advisory 6

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences