All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Jun 13, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Jun 13, 2018 |
| Freebsd | — | Upgrade node6Upgrade nodeUpgrade node8 | Jun 16, 2018 | Jun 15, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Jun 13, 2018 |
| Suse | — | Upgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-toolsUpgrade libsoftokn3Upgrade firefox-libpango-1_0-0Upgrade firefox-glib2-toolsUpgrade libfirefox-glib-2_0-0Upgrade libfreebl3-32bitUpgrade mozilla-nss-32bitUpgrade firefox-libffi4Upgrade firefox-gtk3-immodule-ximUpgrade mozilla-nss-certsUpgrade firefox-libatk-1_0-0Upgrade libfirefox-gio-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-gdk-pixbuf-langUpgrade mozilla-nss-develUpgrade MozillaFirefox-translations-otherUpgrade libfreebl3Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade npm8Upgrade firefox-libgtk-3-0Upgrade nodejs10Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-langUpgrade nodejs8-develUpgrade firefox-libcairo2Upgrade mozilla-nssUpgrade mozilla-nss-certs-32bitUpgrade firefox-atk-langUpgrade mozilla-nss-toolsUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libharfbuzz0Upgrade nodejs10-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nsprUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gthread-2_0-0Upgrade firefox-glib2-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade npm10Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-dataUpgrade nodejs8-docsUpgrade libsoftokn3-32bitUpgrade MozillaFirefoxUpgrade nodejs8Upgrade firefox-libffi7Upgrade firefox-gio-branding-upstreamUpgrade libfirefox-gmodule-2_0-0Upgrade libfirefox-gobject-2_0-0Upgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade MozillaFirefox-translations-commonUpgrade nodejs10-docs | Jul 17, 2018 | Jun 13, 2018 |
| Ubuntu | — | Upgrade nodejs | Nov 19, 2024 | Jun 13, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub