CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2016-3956
High (7.5). EPSS 5.5% chance of exploitation in the next 30 days. Fixed in npm 2.15.1, 3.8.3.
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
Severity
- EPSS
- 5.5% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ibm:sdk
- nodejs:node.js
- npmjs:npm
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m5h6-hr3q-22h5 | npm | npm | <2.15.1 | 2.15.1 |
| GHSA-m5h6-hr3q-22h5 | npm | npm | >=3.0.0 <3.8.3 | 3.8.3 |
References
- http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerability
- http://www-01.ibm.com/support/docview.wss?uid=swg21980827
- https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29
- https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401
- https://github.com/npm/npm/issues/8380