{
  "cve": [
    "CVE-2018-12116"
  ],
  "vulnerable": "6.x || 8.x",
  "patched": "^6.15.0 || ^8.14.0",
  "publish_date": "2018-11-27",
  "author": "Matteo Collina",
  "reported_by": "Arkadiy Tetelman",
  "ref": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/",
  "type": "CWE-115: Misinterpretation of Input",
  "overview": "HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.",
  "affectedEnvironments": [
    "all"
  ],
  "severity": "high"
}