In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Mar 28, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Jun 16, 2020 | Mar 28, 2019 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade npmUpgrade nodejs-debuginfo | Jan 25, 2021 | Mar 28, 2019 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Mar 28, 2019 |
| Freebsd | — | Upgrade node10Upgrade node8Upgrade nodeUpgrade node6 | Mar 3, 2019 | Mar 3, 2019 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Mar 28, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Mar 28, 2019 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade npm | Jan 25, 2021 | Mar 28, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Mar 28, 2019 |
| Suse | — | Upgrade mozilla-nsprUpgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nspr-develUpgrade nodejs8-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-32bitUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfirefox-gio-2_0-0Upgrade libfirefox-gthread-2_0-0Upgrade MozillaFirefox-translations-commonUpgrade nodejs10Upgrade nodejs4-develUpgrade npm8Upgrade firefox-libcairo-gobject2Upgrade MozillaFirefox-branding-SLEDUpgrade nodejs6-develUpgrade firefox-gtk3-dataUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs4Upgrade MozillaFirefoxUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-thaiUpgrade npm6Upgrade libfreebl3Upgrade mozilla-nspr-32bitUpgrade libfreebl3-32bitUpgrade nodejs8Upgrade nodejs10-docsUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libffi7Upgrade nodejs8-docsUpgrade firefox-gio-branding-upstreamUpgrade firefox-atk-langUpgrade firefox-gtk3-immodule-inuktitutUpgrade libsoftokn3-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs6Upgrade firefox-libatk-1_0-0Upgrade firefox-libffi4Upgrade firefox-libcairo2Upgrade nodejs6-docsUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libharfbuzz0Upgrade mozilla-nss-toolsUpgrade mozilla-nssUpgrade firefox-glib2-toolsUpgrade firefox-libgtk-3-0Upgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade npm4Upgrade mozilla-nss-certsUpgrade libsoftokn3Upgrade npm10Upgrade mozilla-nss-develUpgrade firefox-gtk3-langUpgrade nodejs4-docsUpgrade MozillaFirefox-translations-otherUpgrade firefox-libpango-1_0-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-glib2-langUpgrade nodejs10-devel | Apr 1, 2019 | Feb 28, 2019 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro) | Mar 22, 2023 | Mar 28, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub