In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Mar 28, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Jun 16, 2020 | Mar 28, 2019 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-devel-debuginfoUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade npmUpgrade nodejs-debuginfo | Jan 25, 2021 | Mar 28, 2019 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Mar 28, 2019 |
| Freebsd | — | Upgrade node8Upgrade node10Upgrade nodeUpgrade node6 | Mar 3, 2019 | Mar 3, 2019 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Mar 28, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Mar 28, 2019 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-devel-debuginfo | Jan 25, 2021 | Mar 28, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Mar 28, 2019 |
| Suse | — | Upgrade firefox-gtk3-immodule-ximUpgrade firefox-libharfbuzz0Upgrade mozilla-nss-certs-32bitUpgrade firefox-libcairo2Upgrade firefox-libgtk-3-0Upgrade firefox-libatk-1_0-0Upgrade npm4Upgrade nodejs6Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-langUpgrade mozilla-nss-develUpgrade firefox-libffi4Upgrade mozilla-nss-certsUpgrade mozilla-nss-toolsUpgrade mozilla-nssUpgrade firefox-glib2-toolsUpgrade libsoftokn3Upgrade firefox-libpango-1_0-0Upgrade nodejs4-docsUpgrade npm10Upgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-toolsUpgrade nodejs10-develUpgrade nodejs6-docsUpgrade firefox-glib2-langUpgrade MozillaFirefox-translations-otherUpgrade npm6Upgrade nodejs4Upgrade nodejs4-develUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs6-develUpgrade nodejs10Upgrade firefox-gtk3-immodule-multipressUpgrade firefox-libffi7Upgrade libfirefox-gthread-2_0-0Upgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade MozillaFirefoxUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-thaiUpgrade nodejs8-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-32bitUpgrade firefox-atk-langUpgrade firefox-libcairo-gobject2Upgrade libfirefox-gobject-2_0-0Upgrade nodejs8Upgrade npm8Upgrade libsoftokn3-32bitUpgrade libfreebl3Upgrade firefox-gtk3-dataUpgrade mozilla-nsprUpgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nspr-32bitUpgrade nodejs8-docsUpgrade MozillaFirefox-branding-SLEDUpgrade nodejs10-docsUpgrade libfreebl3-32bitUpgrade firefox-gdk-pixbuf-langUpgrade MozillaFirefox-translations-commonUpgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nspr-devel | Apr 1, 2019 | Feb 28, 2019 |
| Ubuntu | — | Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro) | Mar 22, 2023 | Mar 28, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub