Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejsUpgrade npm | May 4, 2022 | Mar 3, 2021 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Mar 3, 2021 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-nodemon | Mar 8, 2021 | Mar 3, 2021 |
| Debian | — | Upgrade nodejs | Feb 26, 2021 | Feb 26, 2021 |
| Freebsd | — | Upgrade node10Upgrade node14Upgrade nodeUpgrade node12 | Mar 10, 2021 | Mar 9, 2021 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Mar 3, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-14 to version 14.16.0-11.4.33.0.1.94.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4 | Apr 21, 2021 | Mar 3, 2021 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs | Mar 6, 2021 | Feb 20, 2021 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docs | Mar 8, 2021 | Mar 3, 2021 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfo | Mar 12, 2024 | Mar 3, 2021 |
| Suse | — | Upgrade nodejs10-develUpgrade nodejs12Upgrade nodejs12-develUpgrade nodejs10-docsUpgrade npm10Upgrade npm14Upgrade nodejs14-develUpgrade nodejs14Upgrade nodejs12-docsUpgrade nodejs14-docsUpgrade npm12Upgrade nodejs10 | Feb 28, 2021 | Feb 26, 2021 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libnode-devUpgrade libnode64Upgrade nodejs | Oct 6, 2023 | Mar 3, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub