Marco Pracucci

**Name of the Vulnerable Software and Affected Versions** Node.js versions 6.x before 6.17.0 Node.js versions 8.x before 8.15.1 Node.js versions 10.x before 10.15.2 Node.js versions 11.x before 11.10.1 **Description** An attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and sending headers very slowly, keeping the connection and associated resources alive for a long period. Potential attacks are mitigated by the use of a load balancer or other proxy layer. **Recommendations** For Node.js versions 6.x before 6.17.0, update to version 6.17.0 or later. For Node.js versions 8.x before 8.15.1, update to version 8.15.1 or later. For Node.js versions 10.x before 10.15.2, update to version 10.15.2 or later. For Node.js versions 11.x before 11.10.1, update to version 11.10.1 or later. As a temporary workaround, consider implementing a load balancer or other proxy layer to mitigate potential attacks.