In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Mar 28, 2019 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Jun 16, 2020 | Mar 28, 2019 |
| Centos_linux | — | Upgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npm | Jan 25, 2021 | Mar 28, 2019 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Mar 28, 2019 |
| Freebsd | — | Upgrade node8Upgrade nodeUpgrade node10Upgrade node6 | Mar 3, 2019 | Mar 3, 2019 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Mar 28, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Mar 28, 2019 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-docs | Jan 25, 2021 | Mar 28, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Mar 28, 2019 |
| Suse | — | Upgrade nodejs4Upgrade libfirefox-gmodule-2_0-0Upgrade libfirefox-gobject-2_0-0Upgrade nodejs8-docsUpgrade nodejs8Upgrade libfreebl3Upgrade firefox-gtk3-branding-upstreamUpgrade MozillaFirefox-translations-commonUpgrade nodejs10Upgrade nodejs4-develUpgrade firefox-gdk-pixbuf-langUpgrade mozilla-nss-32bitUpgrade mozilla-nspr-32bitUpgrade libfreebl3-32bitUpgrade firefox-gtk3-dataUpgrade firefox-atk-langUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nsprUpgrade libsoftokn3-32bitUpgrade libfirefox-gthread-2_0-0Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-libcairo-gobject2Upgrade firefox-gio-branding-upstreamUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libffi7Upgrade npm8Upgrade nodejs6-develUpgrade MozillaFirefoxUpgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs8-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-gdk-pixbuf-query-loadersUpgrade nodejs10-docsUpgrade npm6Upgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-toolsUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nss-toolsUpgrade firefox-libharfbuzz0Upgrade mozilla-nssUpgrade firefox-gtk3-immodule-ximUpgrade mozilla-nss-develUpgrade firefox-glib2-toolsUpgrade firefox-libffi4Upgrade nodejs6Upgrade firefox-libatk-1_0-0Upgrade firefox-libpango-1_0-0Upgrade MozillaFirefox-translations-otherUpgrade nodejs4-docsUpgrade nodejs10-develUpgrade mozilla-nss-certsUpgrade libfirefox-glib-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade npm4Upgrade npm10Upgrade firefox-gtk3-langUpgrade firefox-libcairo2Upgrade libsoftokn3Upgrade firefox-glib2-langUpgrade nodejs6-docs | Apr 1, 2019 | Feb 28, 2019 |
| Ubuntu | — | Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro) | Mar 22, 2023 | Mar 28, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 28, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub