CVE-2017-16005: Header Forgery in http-signature
Summary
CVE-2017-16005: Header Forgery in http-signature. Affects http-signature versions < 0.10.0. Fixed in 0.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The http-signature package is an npm package that provides functionality for signing HTTP requests using various algorithms. It is commonly used for authentication and integrity verification in web applications. However, certain versions of http-signature are vulnerable to header forgery, which allows an attacker in a privileged network position to modify header names and change the meaning of the request without requiring an updated signature.
Vulnerability Detail
The vulnerability in http-signature arises from the fact that it signs the contents of headers but not the header names. This allows an attacker to intercept and tamper with the request headers, modifying the header names and their corresponding values. As a result, the request can be altered in a way that passes signature verification, leading to potential unauthorized access or data manipulation. The impact of this vulnerability depends on the context in which http-signature is used, but it can potentially lead to serious security breaches.
How To Fix
Latest published version: 1.4.0 as of 22 Oct 2026
npm install http-signature@1.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.0
This is the first release that contains the fix.
npm install http-signature@0.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the fixed version of the http-signature package.
Conclusion
The http-signature package is vulnerable to header forgery, which can allow an attacker to modify header names and change the meaning of the request. To mitigate this vulnerability, it is crucial to update to version 0.10.0 or higher of the package. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for http-signature →
FAQ
The impact of this vulnerability depends on the context in which http-signature is used. In certain scenarios, it can lead to unauthorized access or data manipulation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the fixed version of the http-signature package.
The recommended solution is to update to version 0.10.0 or higher of the http-signature package, as it includes a fix for the vulnerability.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/advisories/GHSA-q257-vv4p-fg92.
