Description
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
References (7)
Core 7
Core References
Vendor Advisory
https://security.netapp.com/advisory/ntap-20241227-0008/
Patch, Vendor Advisory x_refsource_confirm
https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/106043
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:1821
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2258
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3497
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/202003-48
Scores
CVSS v3
7.5
EPSS
0.0557
EPSS Percentile
90.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-400
Status
published
Products (16)
nodejs/node.js
11.0.0 - 11.3.0
nodejs/node.js
6.0.0 - 6.15.0
redhat/enterprise_linux
8.0
redhat/enterprise_linux_desktop
7.0
redhat/enterprise_linux_eus
8.1
redhat/enterprise_linux_eus
8.2
redhat/enterprise_linux_eus
8.4
redhat/enterprise_linux_eus
8.6
redhat/enterprise_linux_server
7.0
redhat/enterprise_linux_server_aus
8.2
... and 6 more
Published
Nov 28, 2018
Tracked Since
Feb 18, 2026