CVE-2016-6304: Node.js

High severity, CVSS 7.5. EPSS: 63% chance of exploitation in the next 30 days.

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

Affected products

• Node.js Node.js: from 0.10.0, before 0.10.47 (fixed in 0.10.47); from 0.12.0, before 0.12.16 (fixed in 0.12.16); from 4.0.0, before 4.6.0 (fixed in 4.6.0); from 6.0.0, before 6.7.0 (fixed in 6.7.0)
• Novell Suse Linux Enterprise Module For Web Scripting: version 12.0 only
• OpenSSL OpenSSL: version 1.0.2 only; version 1.0.2a only; version 1.0.2b only; version 1.0.2c only; version 1.0.2d only; version 1.0.2e only; …

Published 2016-09-26. Last modified 2026-06-17.