Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | debian-upgrade-nodejs | Jul 30, 2024 | Mar 28, 2019 | |
| Freebsd | freebsd-upgrade-package-nodefreebsd-upgrade-package-node10freebsd-upgrade-package-node8freebsd-upgrade-package-node6 | Mar 3, 2019 | Mar 3, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-net-libs-nodejs | Mar 23, 2020 | Mar 28, 2019 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-8-8-17-0-11-4-21-0-1-69-0 | Jan 19, 2021 | Mar 28, 2019 | |
| Suse | — | suse-upgrade-nodejs4suse-upgrade-nodejs4-develsuse-upgrade-nodejs4-docssuse-upgrade-nodejs6suse-upgrade-nodejs6-develsuse-upgrade-nodejs6-docssuse-upgrade-npm4suse-upgrade-npm6 | Apr 1, 2019 | Feb 28, 2019 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Mar 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub