PT-2018-17924 · Node.Js · Node.Js

Published 2018-06-13 · Updated 2022-08-29 · CVE-2018-7164

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Node.js versions 9.7.0 and later Node.js versions 10.x

Description A bug in Node.js increases memory consumption when reading from the network into JavaScript using the net.Socket object directly as a stream. This can be exploited by an attacker to cause a denial of service by sending small chunks of data in quick succession.

Recommendations For Node.js versions 9.7.0 and later, revert to the prior behavior to resolve the issue. For Node.js versions 10.x, revert to the prior behavior to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2018-7164

Affected Products

Node.Js

References · 7

• https://security-tracker.debian.org/tracker/CVE-2018-7164 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7164 · Vendor Advisory
• https://nodejs.org/en/blog/vulnerability/june-2018-security-releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7164 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7164 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-48 · Vendor Advisory
• http://securityfocus.com/bid/104463 · Note