In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Mar 28, 2019 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Jun 16, 2020 | Mar 28, 2019 |
| Centos_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-devel-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade npm | Jan 25, 2021 | Mar 28, 2019 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Mar 28, 2019 |
| Freebsd | — | Upgrade node8Upgrade node10Upgrade node6Upgrade node | Mar 3, 2019 | Mar 3, 2019 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Mar 28, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Mar 28, 2019 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-devel-debuginfoUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-debugsource | Jan 25, 2021 | Mar 28, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Mar 28, 2019 |
| Suse | — | Upgrade nodejs6-docsUpgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nss-toolsUpgrade MozillaFirefox-translations-otherUpgrade nodejs4-docsUpgrade mozilla-nssUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-langUpgrade nodejs10-develUpgrade firefox-libgtk-3-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-glib2-toolsUpgrade npm10Upgrade firefox-glib2-langUpgrade firefox-libharfbuzz0Upgrade mozilla-nss-certsUpgrade nodejs6Upgrade firefox-libatk-1_0-0Upgrade mozilla-nss-develUpgrade firefox-libcairo2Upgrade firefox-libffi4Upgrade npm4Upgrade libfirefox-glib-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libpango-1_0-0Upgrade libsoftokn3Upgrade libfreebl3Upgrade npm6Upgrade nodejs4Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-gio-branding-upstreamUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nspr-develUpgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nspr-32bitUpgrade nodejs8-docsUpgrade firefox-libcairo-gobject2Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-dataUpgrade npm8Upgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libffi7Upgrade MozillaFirefoxUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs8-develUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nsprUpgrade nodejs8Upgrade mozilla-nss-32bitUpgrade nodejs10-docsUpgrade firefox-gtk3-immodules-tigrignaUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade MozillaFirefox-translations-commonUpgrade nodejs10Upgrade libfreebl3-32bitUpgrade firefox-atk-langUpgrade nodejs4-develUpgrade nodejs6-devel | Apr 1, 2019 | Feb 28, 2019 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro) | Mar 22, 2023 | Mar 28, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub