Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-devel | May 4, 2022 | Mar 3, 2021 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Mar 3, 2021 |
| Centos_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-packaging | Mar 8, 2021 | Mar 3, 2021 |
| Debian | — | Upgrade nodejs | Feb 26, 2021 | Feb 26, 2021 |
| Freebsd | — | Upgrade node10Upgrade node14Upgrade nodeUpgrade node12 | Mar 10, 2021 | Mar 9, 2021 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Mar 3, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-14 to version 14.16.0-11.4.33.0.1.94.0 on Solaris 11.4 | Apr 21, 2021 | Mar 3, 2021 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs | Mar 6, 2021 | Feb 20, 2021 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade npm | Mar 8, 2021 | Mar 3, 2021 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfo | Mar 12, 2024 | Mar 3, 2021 |
| Suse | — | Upgrade nodejs10-develUpgrade nodejs14-develUpgrade nodejs10-docsUpgrade npm10Upgrade nodejs14Upgrade npm14Upgrade nodejs12Upgrade nodejs12-develUpgrade npm12Upgrade nodejs12-docsUpgrade nodejs10Upgrade nodejs14-docs | Feb 28, 2021 | Feb 26, 2021 |
| Ubuntu | — | Upgrade nodejsUpgrade nodejs-dev (Ubuntu Pro)Upgrade libnode-devUpgrade nodejs (Ubuntu Pro)Upgrade libnode64 | Oct 6, 2023 | Mar 3, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub