In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Mar 28, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Jun 16, 2020 | Mar 28, 2019 |
| Centos_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejs-debuginfo | Jan 25, 2021 | Mar 28, 2019 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Mar 28, 2019 |
| Freebsd | — | Upgrade node6Upgrade nodeUpgrade node10Upgrade node8 | Mar 3, 2019 | Mar 3, 2019 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Mar 28, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Mar 28, 2019 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade nodejs-develUpgrade npm | Jan 25, 2021 | Mar 28, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Mar 28, 2019 |
| Suse | — | Upgrade mozilla-nss-32bitUpgrade nodejs4Upgrade firefox-atk-langUpgrade npm6Upgrade nodejs8-docsUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs4-develUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nspr-develUpgrade nodejs8Upgrade mozilla-nsprUpgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nspr-32bitUpgrade firefox-libffi7Upgrade mozillafirefox-translations-commonUpgrade libsoftokn3-32bitUpgrade npm8Upgrade libfirefox-gmodule-2_0-0Upgrade libfreebl3Upgrade firefox-gtk3-dataUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gio-2_0-0Upgrade libfreebl3-32bitUpgrade nodejs8-develUpgrade libfirefox-gobject-2_0-0Upgrade nodejs10-docsUpgrade nodejs6-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs10Upgrade firefox-gdk-pixbuf-query-loadersUpgrade mozilla-nss-certsUpgrade nodejs6Upgrade mozilla-nss-certs-32bitUpgrade firefox-glib2-langUpgrade nodejs4-docsUpgrade mozillafirefox-branding-sledUpgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodule-ximUpgrade mozilla-nss-develUpgrade firefox-libcairo2Upgrade libsoftokn3Upgrade npm10Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libgtk-3-0Upgrade mozilla-nssUpgrade firefox-libffi4Upgrade libfirefox-glib-2_0-0Upgrade npm4Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-glib2-toolsUpgrade nodejs6-docsUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-toolsUpgrade nodejs10-develUpgrade mozillafirefoxUpgrade mozillafirefox-translations-otherUpgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-langUpgrade firefox-libharfbuzz0 | Apr 1, 2019 | Feb 28, 2019 |
| Ubuntu | — | Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro) | Mar 22, 2023 | Mar 28, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub