All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Jun 13, 2018 |
| Freebsd | — | Upgrade nodeUpgrade node6Upgrade node8 | Jun 16, 2018 | Jun 15, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Jun 13, 2018 |
| Suse | — | Upgrade npm10Upgrade nodejs10-develUpgrade nodejs10-docsUpgrade nodejs10 | Feb 4, 2022 | Jun 13, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub