TI-2017-11732 Aliases CVE-2017-16005 GHSA-q257-vv4p-fg92

Improper input validation in HackerOne http-signature node module

LOW 34CWE-20Published 2018-06-04 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.

Summary

Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.

Why it matters now

EPSS 0.00844 58th percentileScored 2026-11-07

Fix Partial http-signature (npm): 0.10.0Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HackerOne	http-signature node module	up to 0.9.11	—	No fix listed	CNA
—	http-signature (npm)	before 0.10.0	0.10.0	Patch available	GHSA-q257-vv4p-fg92

http-signature node module VendorHackerOne Affected up to 0.9.11 Fixed in — No fix listed CNA
http-signature (npm) Vendor— Affected before 0.10.0 Fixed in 0.10.0 Patch available GHSA-q257-vv4p-fg92

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:joyent:http-signature::::::node.js::*	up to 0.9.11	Vulnerable	Joyent

cpe:2.3:a:joyent:http-signature:*:*:*:*:*:node.js:*:* Versions up to 0.9.11 Vulnerable ·Joyent

Remediation

Fix · GHSA-q257-vv4p-fg92 http-signature (npm) Fixed in 0.10.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 8	Affected	No fix planned: Will not fix

Not affected: 3 products

Red Hat Mobile Application Platform 4
Red Hat OpenShift Enterprise 3
Red Hat Software Collections

Timeline

2026-10-02 Threatist record created from CVE-2017-16005
2026-10-03 Alias added: GHSA-q257-vv4p-fg92

References

Patch 1

https://github.com/joyent/node-http-signature/issues/10

Advisory 3

Other 1

https://www.npmjs.com/advisories/318

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences