CVE-2016-7099

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-19

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0002.html
http://www.securityfocus.com/bid/93191Third Party Advisory, VDB Entry
https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20bIssue Tracking, Patch
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0002.html
http://www.securityfocus.com/bid/93191Third Party Advisory, VDB Entry
https://github.com/nodejs/node/commit/743f0c916469f3129dfae406fa104dc46782e20bIssue Tracking, Patch
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/Patch, Vendor Advisory

Timeline

Published: Oct 10, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-71016.5The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value CVE-2016-71028.4ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special p CVE-2016-71036.1Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via CVE-2016-71077.5Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequ CVE-2016-71086.5Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitra CVE-2016-71099.8Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special character CVE-2016-71109.8Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special character CVE-2016-71114.7MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote at CVE-2016-71129.8A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Mo CVE-2016-71137.5A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Mo CVE-2016-71148.8A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Mo CVE-2016-71159.8Buffer overflow in the handle_packet function in mactelnet.c in the client in MAC-Telnet 0.4.3 and earlier allows remote TELNET servers to e