CVE-2018-7164
HIGHNode.js 9.7.0-9.11.2 - Denial of Service via net.Socket Stream Memory Consumption
Title source: llmDescription
Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/104463
Vendor Advisory x_refsource_confirm
https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/202003-48
Scores
CVSS v3
7.5
EPSS
0.0107
EPSS Percentile
78.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-400
Status
published
Products (1)
nodejs/node.js
9.7.0 - 9.11.2
Published
Jun 13, 2018
Tracked Since
Feb 18, 2026