Not rated
CVE-2019-5737 In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can…
Description
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node.js | Versions not published |
References
- nodejs.org nodejs.org
- openSUSE-SU-2019:1076 lists.opensuse.org
- openSUSE-SU-2019:1173 lists.opensuse.org
- openSUSE-SU-2019:1211 lists.opensuse.org
- security.netapp.com security.netapp.com
- RHSA-2019:1821 access.redhat.com
- GLSA-202003-48 security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of Node.js
The 4 CVEs of Node.js →
CVE-2024-3566
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly…
9.8
Critical
CVE-2024-22019
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked…
7.5
High
CVE-2019-5739
Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier
Not rated