Google V8 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, as demonstrated by attacks against Node.js.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade ruby+nopthreads+onigurumaUpgrade ruby+onigurumaUpgrade rubygem-rackUpgrade nodeUpgrade rubyUpgrade v8Upgrade redisUpgrade jrubyUpgrade ruby+nopthreads | Dec 10, 2025 | Jan 16, 2012 |
| Suse | — | Upgrade v8-private-headers-develUpgrade chromium-desktop-gnomeUpgrade chromium-suid-helper-debuginfoUpgrade libv8-3Upgrade chromium-desktop-kdeUpgrade v8-debugsourceUpgrade chromiumUpgrade chromium-suid-helperUpgrade chromium-debuginfoUpgrade chromium-debugsourceUpgrade v8-develUpgrade v8Upgrade libv8-3-debuginfo | Dec 12, 2013 | Dec 29, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub