{"action":"Upgrade nodejs to 4.3.0~dfsg-1 or later.","affected":[{"fixed":"4.3.0~dfsg-1","introduced":"0"}],"component":"nodejs","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["4.3.0~dfsg-1"],"id":"tcs_01M5NBGEQ20971R9M6HG6DBVTC","modified_at":"2026-09-22T07:00:39.880198504Z","published_at":"2016-04-07T21:59:01.900Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2016-2086","https://security-tracker.debian.org/tracker/CVE-2016-2086"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2016-2086#Debian:14/nodejs","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2016-2086"}],"summary":"Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header."}