Not rated
CVE-2019-5739 Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier
Description
Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node.js | Versions not published |
References
- nodejs.org nodejs.org
- openSUSE-SU-2019:1076 lists.opensuse.org
- openSUSE-SU-2019:1173 lists.opensuse.org
- security.netapp.com security.netapp.com
- GLSA-202003-48 security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of Node.js
The 4 CVEs of Node.js →
CVE-2024-3566
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly…
9.8
Critical
CVE-2024-22019
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked…
7.5
High
CVE-2019-5737
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can…
Not rated