CVE-2016-3956

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.

• CWE-200

• https://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerabilityVendor Advisory
• https://www-01.ibm.com/support/docview.wss?uid=swg21980827Vendor Advisory
• https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29Patch, Third Party Advisory
• https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401Patch, Third Party Advisory
• https://github.com/npm/npm/issues/8380Third Party Advisory
• https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/Vendor Advisory
• https://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerabilityVendor Advisory
• https://www-01.ibm.com/support/docview.wss?uid=swg21980827Vendor Advisory
• https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29Patch, Third Party Advisory
• https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401Patch, Third Party Advisory
• https://github.com/npm/npm/issues/8380Third Party Advisory
• https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/Vendor Advisory

Published

Jul 2, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3950Huawei AR3200 routers with software before V200R006C10SPC300…
• CVE-2016-3951Double free vulnerability in drivers/net/usb/cdc_ncm.c in th…
• CVE-2016-3952web2py before 2.14.1, when using the standalone version, all…
• CVE-2016-3953The sample web application in web2py before 2.14.2 might all…
• CVE-2016-3954web2py before 2.14.2 allows remote attackers to obtain the s…
• CVE-2016-3955The usbip_recv_xbuff function in drivers/usb/usbip/usbip_com…9.8
• CVE-2016-3957The secure_load function in gluon/utils.py in web2py before …
• CVE-2016-3958Untrusted search path vulnerability in Go before 1.5.4 and 1…7.8
• CVE-2016-3959The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 …
• CVE-2016-3960Integer overflow in the x86 shadow pagetable code in Xen all…
• CVE-2016-3961Xen and the Linux kernel through 4.5.x do not properly suppr…
• CVE-2016-3962Stack-based buffer overflow in the NTP time-server interface…