CVE-2016-3956

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerabilityVendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21980827Vendor Advisory
https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29Patch, Third Party Advisory
https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401Patch, Third Party Advisory
https://github.com/npm/npm/issues/8380Third Party Advisory
https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/Vendor Advisory
http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerabilityVendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21980827Vendor Advisory
https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29Patch, Third Party Advisory
https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401Patch, Third Party Advisory
https://github.com/npm/npm/issues/8380Third Party Advisory
https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/Vendor Advisory

Timeline

Published: Jul 2, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-39579.8The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, w CVE-2016-39587.8Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan CVE-2016-39597.5The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big inte CVE-2016-39608.8Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly g CVE-2016-39615.5Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to CVE-2016-39627.3Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M90 CVE-2016-39635.3Siemens SCALANCE S613 allows remote attackers to cause a denial of service (web-server outage) via traffic to TCP port 443.CVE-2016-39686.1Multiple cross-site scripting (XSS) vulnerabilities in Sophos Cyberoam CR100iNG UTM appliance with firmware 10.6.3 MR-1 build 503, CR35iNG U CVE-2016-39696.1Cross-site scripting (XSS) vulnerability in McAfee Email Gateway (MEG) 7.6.x before 7.6.404, when File Filtering is enabled with the action CVE-2016-39714.8Cross-site scripting (XSS) vulnerability in lucene_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script CVE-2016-39722.7Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitra CVE-2016-39735.3The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers