Jan Maybach

**Name of the Vulnerable Software and Affected Versions** Node.js versions 6.x before 6.17.0 Node.js versions 8.x before 8.15.1 Node.js versions 10.x before 10.15.2 Node.js versions 11.x before 11.10.1 **Description** An attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and sending headers very slowly, keeping the connection and associated resources alive for a long period. Potential attacks are mitigated by the use of a load balancer or other proxy layer. **Recommendations** For Node.js versions 6.x before 6.17.0, update to version 6.17.0 or later. For Node.js versions 8.x before 8.15.1, update to version 8.15.1 or later. For Node.js versions 10.x before 10.15.2, update to version 10.15.2 or later. For Node.js versions 11.x before 11.10.1, update to version 11.10.1 or later. As a temporary workaround, consider implementing a load balancer or other proxy layer to mitigate potential attacks.

**Name of the Vulnerable Software and Affected Versions** Node.js versions prior to 6.15.0 Node.js versions prior to 8.14.0 Node.js versions prior to 10.14.0 Node.js versions prior to 11.3.0 **Description** The issue allows an attacker to cause a Denial of Service (DoS) by sending headers very slowly, keeping HTTP or HTTPS connections and associated resources alive for a long period of time. **Recommendations** For versions prior to 6.15.0, update to version 6.15.0 or later. For versions prior to 8.14.0, update to version 8.14.0 or later. For versions prior to 10.14.0, update to version 10.14.0 or later. For versions prior to 11.3.0, update to version 11.3.0 or later.