All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Jun 13, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Jun 13, 2018 |
| Freebsd | — | Upgrade nodeUpgrade node6Upgrade node8 | Jun 16, 2018 | Jun 15, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Jun 13, 2018 |
| Suse | — | Upgrade firefox-gtk3-langUpgrade nodejs8-develUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libcairo2Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade npm10Upgrade nodejs10-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade MozillaFirefox-translations-commonUpgrade mozilla-nsprUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gthread-2_0-0Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-dataUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libharfbuzz0Upgrade nodejs8-docsUpgrade mozilla-nspr-32bitUpgrade MozillaFirefoxUpgrade nodejs8Upgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libffi7Upgrade mozilla-nspr-develUpgrade libsoftokn3-32bitUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs10-docsUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nss-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade libfreebl3Upgrade nodejs10Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-libcairo-gobject2Upgrade firefox-libpango-1_0-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libgtk-3-0Upgrade npm8Upgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-toolsUpgrade mozilla-nssUpgrade libsoftokn3Upgrade libfreebl3-32bitUpgrade mozilla-nss-develUpgrade firefox-libatk-1_0-0Upgrade libfirefox-gio-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade mozilla-nss-toolsUpgrade firefox-atk-langUpgrade firefox-libffi4Upgrade mozilla-nss-certsUpgrade MozillaFirefox-translations-other | Jul 17, 2018 | Jun 13, 2018 |
| Ubuntu | — | Upgrade nodejs | Nov 19, 2024 | Jun 13, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub