In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Mar 28, 2019 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Jun 16, 2020 | Mar 28, 2019 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-nodemon | Jan 25, 2021 | Mar 28, 2019 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Mar 28, 2019 |
| Freebsd | — | Upgrade nodeUpgrade node6Upgrade node10Upgrade node8 | Mar 3, 2019 | Mar 3, 2019 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Mar 28, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Mar 28, 2019 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-debugsource | Jan 25, 2021 | Mar 28, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Mar 28, 2019 |
| Suse | — | Upgrade nodejs10Upgrade firefox-atk-langUpgrade nodejs4-develUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs10-docsUpgrade firefox-gdk-pixbuf-langUpgrade nodejs6-develUpgrade mozilla-nspr-develUpgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-32bitUpgrade firefox-gdk-pixbuf-query-loadersUpgrade npm6Upgrade firefox-libcairo-gobject2Upgrade libfirefox-gmodule-2_0-0Upgrade libfirefox-gio-2_0-0Upgrade mozilla-nsprUpgrade nodejs8Upgrade libfreebl3Upgrade libfirefox-gobject-2_0-0Upgrade npm8Upgrade mozillafirefox-translations-commonUpgrade nodejs4Upgrade libfirefox-gthread-2_0-0Upgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libffi7Upgrade firefox-gio-branding-upstreamUpgrade nodejs8-docsUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-dataUpgrade nodejs8-develUpgrade mozilla-nssUpgrade nodejs6-docsUpgrade firefox-gtk3-langUpgrade mozilla-nss-toolsUpgrade mozillafirefoxUpgrade nodejs6Upgrade firefox-libffi4Upgrade firefox-libpango-1_0-0Upgrade firefox-libatk-1_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade npm4Upgrade mozillafirefox-translations-otherUpgrade mozilla-nss-certsUpgrade libfirefox-glib-2_0-0Upgrade npm10Upgrade firefox-libcairo2Upgrade mozilla-nss-develUpgrade libsoftokn3Upgrade mozilla-nss-certs-32bitUpgrade firefox-glib2-langUpgrade nodejs10-develUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-immodule-ximUpgrade firefox-glib2-toolsUpgrade firefox-libgtk-3-0Upgrade mozillafirefox-branding-sledUpgrade firefox-libharfbuzz0Upgrade nodejs4-docsUpgrade firefox-gtk3-immodule-amharic | Apr 1, 2019 | Feb 28, 2019 |
| Ubuntu | — | Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro) | Mar 22, 2023 | Mar 28, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub