CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2017-16005
Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme". In versions <=0.9.11, http-signature signs only the header values, but not the header names. This makes http-signature vulnerable to header forgery. Thus, if an attacker can intercept a request, he can swap header names and change the meaning of the request without changing the signature.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-347, CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- joyent:http-signature
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q257-vv4p-fg92 | npm | http-signature | <0.10.0 | 0.10.0 |