Node.Js · Node.Js · CVE-2018-12116
**Name of the Vulnerable Software and Affected Versions**
Node.js versions prior to 6.15.0
Node.js versions prior to 8.14.0
**Description**
The issue is related to HTTP request splitting, where Node.js can be tricked into using unsanitized user-provided Unicode data for the `path` option of an HTTP request. This can lead to a second, unexpected HTTP request being made to the same server. The vulnerability is also associated with errors in handling HTTP packets, which can allow a remote attacker to gain unauthorized access to protected data using HTTP requests.
**Recommendations**
For versions prior to 6.15.0, update to version 6.15.0 or later.
For versions prior to 8.14.0, update to version 8.14.0 or later.