Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | Nov 28, 2018 |
| Amazon Linux Ami 2 | — | Upgrade http-parser-develUpgrade http-parserUpgrade http-parser-debuginfo | Apr 27, 2020 | Nov 28, 2018 |
| Amazon_linux | — | Upgrade http-parser | Apr 24, 2020 | Nov 28, 2018 |
| Centos_linux | — | Upgrade http-parser-develUpgrade http-parser-debugsourceUpgrade http-parser-debuginfoUpgrade http-parser | Aug 28, 2019 | Nov 28, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Nov 28, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node6Upgrade node8Upgrade nodeUpgrade node10 | Dec 10, 2018 | Dec 10, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Nov 28, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade http-parser | Jun 17, 2020 | Nov 28, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade http-parser | Nov 19, 2019 | Nov 28, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade http-parser | Nov 19, 2019 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 28, 2018 |
| Oracle_linux | — | Upgrade http-parserUpgrade http-parser-devel | Jul 21, 2020 | Nov 27, 2018 |
| Redhat_linux | — | Upgrade http-parser-develUpgrade http-parser-debugsourceUpgrade http-parser-debuginfoUpgrade http-parser | Aug 7, 2019 | Nov 28, 2018 |
| Suse | — | Upgrade nodejs4-docsUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libharfbuzz0Upgrade mozillafirefox-translations-commonUpgrade nodejs10-docsUpgrade firefox-gtk3-immodule-vietnameseUpgrade libfirefox-gthread-2_0-0Upgrade nodejs4Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodules-tigrignaUpgrade npm10Upgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs8-docsUpgrade mozilla-nspr-32bitUpgrade libfreebl3Upgrade mozillafirefox-translations-otherUpgrade mozilla-nspr-develUpgrade firefox-glib2-langUpgrade libsoftokn3-32bitUpgrade npm6Upgrade nodejs10-develUpgrade mozilla-nsprUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libffi7Upgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gobject-2_0-0Upgrade nodejs6Upgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-amharicUpgrade nodejs8-develUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-toolsUpgrade mozilla-nss-toolsUpgrade libfreebl3-32bitUpgrade mozilla-nss-32bitUpgrade mozilla-nss-certsUpgrade firefox-libcairo-gobject2Upgrade firefox-gdk-pixbuf-langUpgrade npm4Upgrade firefox-libcairo2Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libatk-1_0-0Upgrade firefox-libffi4Upgrade nodejs8Upgrade firefox-gtk3-immodule-ximUpgrade firefox-atk-langUpgrade mozilla-nssUpgrade mozillafirefox-branding-sledUpgrade mozilla-nss-certs-32bitUpgrade npm8Upgrade mozillafirefoxUpgrade nodejs10Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-langUpgrade mozilla-nss-develUpgrade nodejs4-develUpgrade nodejs6-docsUpgrade nodejs6-develUpgrade libsoftokn3Upgrade firefox-libpango-1_0-0Upgrade libfirefox-glib-2_0-0Upgrade firefox-glib2-tools | Jan 31, 2019 | Nov 28, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Nov 28, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub