Non notée
CVE-2019-5739 Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier
Description
Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Node.js | Versions non publiées |
Références
- nodejs.org nodejs.org
- openSUSE-SU-2019:1076 lists.opensuse.org
- openSUSE-SU-2019:1173 lists.opensuse.org
- security.netapp.com security.netapp.com
- GLSA-202003-48 security.gentoo.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Node.js
Les 4 CVE de Node.js →
CVE-2024-3566
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly…
9.8
Critique
CVE-2024-22019
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked…
7.5
Élevée
CVE-2019-5737
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can…
Non notée