{"metadata": {"vulnerability": "CVE-2018-12116", "count": 88, "kinds": {"milestone": 14, "sighting": 1, "kev": 0, "other": 73}}, "data": [{"timestamp": "2018-04-30T00:00:00Z", "date_only": false, "value": "2018-04-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2018-04-30T00:00:00Z", "date_only": false, "value": "2018-04-30T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2018-06-11T00:00:00Z", "date_only": false, "value": "2018-06-11T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2018-12116", "field": "cveMetadata.dateReserved"}, {"timestamp": "2018-11-02T00:00:00Z", "date_only": false, "value": "2018-11-02T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2018-12116", "record": "MSRC_CVE-2018-12116", "field": "document.tracking.initial_release_date"}, {"timestamp": "2018-11-27T00:00:00Z", "date_only": false, "value": "2018-11-27T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2018-11-27T00:00:00Z", "date_only": false, "value": "2018-11-27T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2018-11-28T00:00:00Z", "date_only": false, "value": "2018-11-28T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2018-11-28T00:00:00Z", "date_only": false, "value": "2018-11-28T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2018-11-28T00:00:00Z", "date_only": false, "value": "2018-11-28T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / nodejs", "record": "CVE-2018-12116", "field": "containers.cna.datePublic"}, {"timestamp": "2018-11-28T17:00:00Z", "date_only": false, "value": "2018-11-28T17:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2018-12116", "field": "cveMetadata.datePublished"}, {"timestamp": "2018-11-28T17:29:00Z", "date_only": false, "value": "2018-11-28T17:29:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MFJX-W835-F3W2", "record": "GHSA-MFJX-W835-F3W2", "field": "database_specific.nvd_published_at"}, {"timestamp": "2018-11-28T17:29:00Z", "date_only": false, "value": "2018-11-28T17:29:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2018-12116", "record": "UBUNTU-CVE-2018-12116", "field": "published"}, {"timestamp": "2018-11-28T17:29:00Z", "date_only": false, "value": "2018-11-28T17:29Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2018-12116", "record": "GSD-2018-12116", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2018-11-28T17:29:00.230Z", "date_only": false, "value": "2018-11-28T17:29:00.230", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2018-12116", "record": "FKIE_CVE-2018-12116", "field": "published"}, {"timestamp": "2018-11-30T00:00:00Z", "date_only": true, "value": "2018-11-30", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2019-42556", "record": "CNVD-2019-42556", "field": "submitTime"}, {"timestamp": "2019-01-18T10:52:41Z", "date_only": false, "value": "2019-01-18T10:52:41Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2019:0117-1", "record": "SUSE-SU-2019:0117-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2019-01-18T10:52:41Z", "date_only": false, "value": "2019-01-18T10:52:41Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2019:0117-1", "record": "SUSE-SU-2019:0117-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2019-01-18T10:52:41Z", "date_only": false, "value": "2019-01-18T10:52:41Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2019:0117-1", "record": "SUSE-SU-2019:0117-1", "field": "document.tracking.generator.date"}, {"timestamp": "2019-01-18T10:52:41Z", "date_only": false, "value": "2019-01-18T10:52:41Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2019:0117-1", "record": "SUSE-SU-2019:0117-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2019-01-18T10:52:58Z", "date_only": false, "value": "2019-01-18T10:52:58Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2019:0118-1", "record": "SUSE-SU-2019:0118-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2019-01-18T10:52:58Z", "date_only": false, "value": "2019-01-18T10:52:58Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2019:0118-1", "record": "SUSE-SU-2019:0118-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2019-01-18T10:52:58Z", "date_only": false, "value": "2019-01-18T10:52:58Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2019:0118-1", "record": "SUSE-SU-2019:0118-1", "field": "document.tracking.generator.date"}, {"timestamp": "2019-01-18T10:52:58Z", "date_only": false, "value": "2019-01-18T10:52:58Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2019:0118-1", "record": "SUSE-SU-2019:0118-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2019-02-14T13:59:06Z", "date_only": false, "value": "2019-02-14T13:59:06Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2019:0395-1", "record": "SUSE-SU-2019:0395-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2019-02-14T13:59:06Z", "date_only": false, "value": "2019-02-14T13:59:06Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2019:0395-1", "record": "SUSE-SU-2019:0395-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2019-02-14T13:59:06Z", "date_only": false, "value": "2019-02-14T13:59:06Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2019:0395-1", "record": "SUSE-SU-2019:0395-1", "field": "document.tracking.generator.date"}, {"timestamp": "2019-02-14T13:59:06Z", "date_only": false, "value": "2019-02-14T13:59:06Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2019:0395-1", "record": "SUSE-SU-2019:0395-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2019-02-28T00:00:00Z", "date_only": false, "value": "2019-02-28T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2019-02-28T00:00:00Z", "date_only": false, "value": "2019-02-28T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2019-03-01T00:00:00Z", "date_only": false, "value": "2019-03-01T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2019-03-01T00:00:00Z", "date_only": false, "value": "2019-03-01T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2019-03-23T10:49:42Z", "date_only": false, "value": "2019-03-23T10:49:42Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2019:0089-1", "record": "OPENSUSE-SU-2019:0089-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2019-03-23T10:49:42Z", "date_only": false, "value": "2019-03-23T10:49:42Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2019:0089-1", "record": "OPENSUSE-SU-2019:0089-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2019-03-23T10:49:42Z", "date_only": false, "value": "2019-03-23T10:49:42Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2019:0089-1", "record": "OPENSUSE-SU-2019:0089-1", "field": "document.tracking.generator.date"}, {"timestamp": "2019-03-23T10:49:42Z", "date_only": false, "value": "2019-03-23T10:49:42Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2019:0089-1", "record": "OPENSUSE-SU-2019:0089-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2019-04-07T00:00:00Z", "date_only": false, "value": "2019-04-07T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2019-04-07T00:00:00Z", "date_only": false, "value": "2019-04-07T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2019-07-22T13:39:40Z", "date_only": false, "value": "2019-07-22T13:39:40+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2019-07-22T13:39:40Z", "date_only": false, "value": "2019-07-22T13:39:40+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2019-07-22T13:39:40Z", "date_only": false, "value": "2019-07-22T13:39:40+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2019-07-22T13:39:40Z", "date_only": false, "value": "2019-07-22T13:39:40+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2019-07-22T13:39:40Z", "date_only": false, "value": "2019-07-22T13:39:40+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "document.tracking.initial_release_date"}, {"timestamp": "2019-07-22T13:39:40Z", "date_only": false, "value": "2019-07-22T13:39:40+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "document.tracking.initial_release_date"}, {"timestamp": "2019-07-22T22:00:00Z", "date_only": false, "value": "2019-07-22T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2535", "record": "WID-SEC-W-2023-2535", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2019-07-22T22:00:00Z", "date_only": false, "value": "2019-07-22T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2535", "record": "WID-SEC-W-2023-2535", "field": "document.tracking.initial_release_date"}, {"timestamp": "2019-07-22T22:00:00Z", "date_only": false, "value": "2019-07-22T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2535", "record": "WID-SEC-W-2023-2535", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2019-11-27T00:00:00Z", "date_only": true, "value": "2019-11-27", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2019-42556", "record": "CNVD-2019-42556", "field": "openTime"}, {"timestamp": "2020-01-17T17:07:38Z", "date_only": false, "value": "2020-01-17T17:07:38Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2019:14246-1", "record": "SUSE-SU-2019:14246-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2020-01-17T17:07:38Z", "date_only": false, "value": "2020-01-17T17:07:38Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2019:14246-1", "record": "SUSE-SU-2019:14246-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2020-01-17T17:07:38Z", "date_only": false, "value": "2020-01-17T17:07:38Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2019:14246-1", "record": "SUSE-SU-2019:14246-1", "field": "document.tracking.generator.date"}, {"timestamp": "2020-01-17T17:07:38Z", "date_only": false, "value": "2020-01-17T17:07:38Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2019:14246-1", "record": "SUSE-SU-2019:14246-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2020-03-20T20:06:04Z", "date_only": false, "value": "2020-03-20T20:06:04.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / nodejs", "record": "CVE-2018-12116", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-06-06T00:00:00Z", "date_only": false, "value": "2021-06-06T00:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2018-12116", "record": "MSRC_CVE-2018-12116", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2021-06-06T00:00:00Z", "date_only": false, "value": "2021-06-06T00:00:00.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2018-12116", "record": "MSRC_CVE-2018-12116", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2021-06-06T00:00:00Z", "date_only": false, "value": "2021-06-06T00:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2018-12116", "record": "MSRC_CVE-2018-12116", "field": "document.tracking.current_release_date"}, {"timestamp": "2022-05-13T01:27:48Z", "date_only": false, "value": "2022-05-13T01:27:48Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MFJX-W835-F3W2", "record": "GHSA-MFJX-W835-F3W2", "field": "published"}, {"timestamp": "2022-08-29T20:24:00Z", "date_only": false, "value": "2022-08-29T20:24Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2018-12116", "record": "GSD-2018-12116", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2023-10-03T22:00:00Z", "date_only": false, "value": "2023-10-03T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2535", "record": "WID-SEC-W-2023-2535", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2023-10-03T22:00:00Z", "date_only": false, "value": "2023-10-03T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2535", "record": "WID-SEC-W-2023-2535", "field": "document.tracking.current_release_date"}, {"timestamp": "2023-12-13T01:22:30.029Z", "date_only": false, "value": "2023-12-13T01:22:30.029129Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2018-12116", "record": "GSD-2018-12116", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-05T08:24:03.673Z", "date_only": false, "value": "2024-08-05T08:24:03.673Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2018-12116", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-15T17:59:19.823Z", "date_only": false, "value": "2024-08-15T17:59:19.823+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2023-2535", "record": "WID-SEC-W-2023-2535", "field": "document.tracking.generator.date"}, {"timestamp": "2024-12-13T14:52:32Z", "date_only": false, "value": "2024-12-13T14:52:32+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2024-12-13T14:52:32Z", "date_only": false, "value": "2024-12-13T14:52:32+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "document.tracking.generator.date"}, {"timestamp": "2024-12-13T14:52:32Z", "date_only": false, "value": "2024-12-13T14:52:32+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2019_1821", "record": "RHSA-2019_1821", "field": "document.tracking.current_release_date"}, {"timestamp": "2025-10-19T17:23:54.152Z", "date_only": false, "value": "2025-10-19T17:23:54.152Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2018-12116", "record": "MSRC_CVE-2018-12116", "field": "document.tracking.generator.date"}, {"timestamp": "2026-03-05T09:58:04Z", "date_only": false, "value": "2026-03-05T09:58:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/5968", "record": "CVE-2018-12116", "field": "creation_timestamp", "uuid": "68db84e0-5c90-4037-b0a1-45ad4a18abd6", "content": "\u00ab\u0417\u0430\u0431\u044b\u0442\u044b\u0439\u00bb \u0431\u0430\u0433: TOCTOU \u0432 ClientRequest Node.js \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 HTTP request splitting\n#NodeJS #HTTP #TOCTOU #CRLF #AppSec #WebSecurity\n\n\u0412 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 ClientRequest \u0432 Node.js \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0441\u0442\u0430\u0440\u044b\u0439 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u0435\u0444\u0435\u043a\u0442 \u2014 TOCTOU \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u0443\u044e \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044e path \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c CRLF-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0442\u0440\u043e\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0438\u0441\u0442\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0435\u0440\u0435\u0441\u0435\u043a\u0430\u0435\u0442\u0441\u044f \u0441 \u043c\u0435\u0440\u0430\u043c\u0438, \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0438 CVE-2018-12116 (\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043d\u0430 \u043d\u0435\u043f\u0435\u0447\u0430\u0442\u0430\u0435\u043c\u044b\u0435/Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u044b).\n\n\u267e\ufe0f\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438\u267e\ufe0f\n\n\u041f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0447\u0435\u0440\u0435\u0437 http.request(options) Node.js \u0432\u0430\u043b\u0438\u0434\u0438\u0440\u0443\u0435\u0442 options.path (\u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0437\u0430\u043f\u0440\u0435\u0442 \\r \u0438 \\n) \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439 \u0432 request line.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0435\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u00ab\u043d\u043e\u00bb:\n\n\u25aa\ufe0f\u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u043e\u0431\u044a\u0435\u043a\u0442\u0430 ClientRequest \u0438 \u0434\u0430\u043b\u0435\u0435 \u043c\u043e\u0436\u0435\u0442 \u043d\u0435 \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u0441\u044f, \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 Node.js\n\u25aa\ufe0fthis.path \u2014 \u043e\u0431\u044b\u0447\u043d\u043e\u0435 \u0438\u0437\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0435 \u043f\u043e\u043b\u0435 JS-\u043e\u0431\u044a\u0435\u043a\u0442\u0430 (\u043d\u0435 \u0437\u0430\u043c\u043e\u0440\u043e\u0436\u0435\u043d\u043e), \u0442\u043e \u0435\u0441\u0442\u044c \u0445\u0440\u0430\u043d\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u043e\u0431\u044b\u0447\u043d\u043e\u0435 JS-\u0441\u0432\u043e\u0439\u0441\u0442\u0432\u043e\n\u25aa\ufe0f\u041f\u043e\u0441\u043b\u0435 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043e\u0431\u044a\u0435\u043a\u0442 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u043e\u0434\u043e\u043c, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, middleware/\u043f\u0440\u043e\u043a\u0441\u0438-\u043b\u043e\u0433\u0438\u043a\u043e\u0439\n\u25aa\ufe0f\u041f\u0440\u0438 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 request line \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0442\u0435\u043a\u0443\u0449\u0435\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 this.path, \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u0430\u044f \u0441\u0442\u0440\u043e\u0433\u0430\u044f \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044f \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 Node.js\n\n\u0415\u0441\u043b\u0438 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435\u043c \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u043e\u0439 path \u0431\u0443\u0434\u0435\u0442 \u0438\u0437\u043c\u0435\u043d\u0435\u043d \u043d\u0430 \u0441\u0442\u0440\u043e\u043a\u0443 \u0441 \\r \\n, \u044d\u0442\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u044b \u043c\u043e\u0433\u0443\u0442 \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0442\u0440\u0430\u0444\u0438\u043a, \u0447\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a request splitting \u0438\u043b\u0438 header injection (\u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0432\u0435\u0440\u0441\u0438\u0438).\n\n\u267e\ufe0f\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f\u267e\ufe0f\n\n\u25aa\ufe0f\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0440\u043e\u043a\u0441\u0438-\u043b\u043e\u0433\u0438\u043a\u0443, \u0433\u0434\u0435 path \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0438\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0433\u043e \u0432\u0432\u043e\u0434\u0430.\n\u25aa\ufe0f\u0412 URL \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u044b CRLF:  /proxy/something%0D%0AHost:%20evil.com%0D%0A...\n\u25aa\ufe0f\u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u0443\u0435\u0442 %0D%0A \u2192 \\r \\n \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 proxyReq.path = decoded.\n\u25aa\ufe0f\u041f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 path \u0443\u0436\u0435 \u043f\u0440\u043e\u0439\u0434\u0435\u043d\u0430 \u043d\u0430 \u00ab\u0447\u0438\u0441\u0442\u043e\u043c\u00bb \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0438.\n\u25aa\ufe0f\u041f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0441\u0442\u0440\u043e\u043a\u0430 \u0432\u0440\u043e\u0434\u0435:  GET /something\\r\\nHost: evil.com\\r\\n... HTTP/1.1\\r\\n...\n\u25aa\ufe0fDownstream-\u0441\u0435\u0440\u0432\u0435\u0440, \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0430\u0440\u0441\u0435\u0440\u0430 \u0438 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438, \u043c\u043e\u0436\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u043e \u043a\u0430\u043a \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0438\u043b\u0438 \u043a\u0430\u043a \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\n\n\u267e\ufe0f\u0418\u043c\u043f\u0430\u043a\u0442\u267e\ufe0f\n\n\u25aa\ufe0f\u041f\u043e\u0434\u043c\u0435\u043d\u0430 Host \u0438\u043b\u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 Authorization\n\u25aa\ufe0f\u0414\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0430\u043c, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, /admin\n\u25aa\ufe0f\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432\n\u25aa\ufe0f\u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0435 request splitting \u0431\u0435\u0437 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0434\u0435\u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u0430\u043a \u043f\u0440\u0438 smuggling\n\n\ud83d\udd17\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\n\n\ud83c\udf1a @poxek | \ud83d\udcf2 MAX |\ud83c\udf1a \u0411\u043b\u043e\u0433 | \ud83d\udcfa YT | \ud83d\udcfa RT | \ud83d\udcfa VK", "url": "https://t.me/poxek/5968"}, {"timestamp": "2026-04-22T07:38:38Z", "date_only": false, "value": "2026-04-22T07:38:38Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2018-12116", "record": "UBUNTU-CVE-2018-12116", "field": "modified"}, {"timestamp": "2026-08-04T21:51:08Z", "date_only": false, "value": "2026-08-04T21:51:08+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-08-04T21:51:08Z", "date_only": false, "value": "2026-08-04T21:51:08+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-04T21:51:08Z", "date_only": false, "value": "2026-08-04T21:51:08+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2019:1821", "record": "RHSA-2019:1821", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-20T13:03:11Z", "date_only": false, "value": "2026-09-20T13:03:11Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2019:0117-1", "record": "SUSE-SU-2019:0117-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T13:03:11Z", "date_only": false, "value": "2026-09-20T13:03:11Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2019:0117-1", "record": "SUSE-SU-2019:0117-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-20T13:03:13Z", "date_only": false, "value": "2026-09-20T13:03:13Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2019:0118-1", "record": "SUSE-SU-2019:0118-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T13:03:13Z", "date_only": false, "value": "2026-09-20T13:03:13Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2019:0118-1", "record": "SUSE-SU-2019:0118-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-20T13:04:41Z", "date_only": false, "value": "2026-09-20T13:04:41Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2019:0395-1", "record": "SUSE-SU-2019:0395-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T13:04:41Z", "date_only": false, "value": "2026-09-20T13:04:41Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2019:0395-1", "record": "SUSE-SU-2019:0395-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-20T13:12:44Z", "date_only": false, "value": "2026-09-20T13:12:44Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2019:14246-1", "record": "SUSE-SU-2019:14246-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T18:46:44Z", "date_only": false, "value": "2026-09-20T18:46:44Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2019:0089-1", "record": "OPENSUSE-SU-2019:0089-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-20T18:46:44Z", "date_only": false, "value": "2026-09-20T18:46:44Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2019:0089-1", "record": "OPENSUSE-SU-2019:0089-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-08T21:10:53.578Z", "date_only": false, "value": "2026-10-08T21:10:53.578347Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2018-12116", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-08T21:10:53.578Z", "date_only": false, "value": "2026-10-08T21:10:53.578347Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2018-12116", "record": "FKIE_CVE-2018-12116", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-08T21:14:00.789Z", "date_only": false, "value": "2026-10-08T21:14:00.789Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2018-12116", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-08T21:14:00.789Z", "date_only": false, "value": "2026-10-08T21:14:00.789Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2018-12116", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-08T22:16:44.543Z", "date_only": false, "value": "2026-10-08T22:16:44.543", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2018-12116", "record": "FKIE_CVE-2018-12116", "field": "lastModified"}, {"timestamp": "2026-10-09T00:30:58Z", "date_only": false, "value": "2026-10-09T00:30:58Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MFJX-W835-F3W2", "record": "GHSA-MFJX-W835-F3W2", "field": "modified"}, {"timestamp": "2026-10-11T11:42:49Z", "date_only": false, "value": "2026-10-11T11:42:49Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2019:14246-1", "record": "SUSE-SU-2019:14246-1", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-11T11:42:49Z", "date_only": false, "value": "2026-10-11T11:42:49Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2019:14246-1", "record": "SUSE-SU-2019:14246-1", "field": "document.tracking.current_release_date"}]}