PT-2019-17836 · Node.Js+7 · Node.Js+7
Jan Maybach
+1
·
Published
2019-01-28
·
Updated
2026-05-18
·
CVE-2019-5737
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Node.js versions 6.x before 6.17.0
Node.js versions 8.x before 8.15.1
Node.js versions 10.x before 10.15.2
Node.js versions 11.x before 11.10.1
Description
An attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and sending headers very slowly, keeping the connection and associated resources alive for a long period. Potential attacks are mitigated by the use of a load balancer or other proxy layer.
Recommendations
For Node.js versions 6.x before 6.17.0, update to version 6.17.0 or later.
For Node.js versions 8.x before 8.15.1, update to version 8.15.1 or later.
For Node.js versions 10.x before 10.15.2, update to version 10.15.2 or later.
For Node.js versions 11.x before 11.10.1, update to version 11.10.1 or later.
As a temporary workaround, consider implementing a load balancer or other proxy layer to mitigate potential attacks.
Fix
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Node.Js
Red Hat
Rocky Linux
Suse
Ubuntu