Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveNodejsCVE-2019-5737
HistoryMar 28, 2019 - 5:29 p.m.

CVE-2019-5737

2019-03-2817:29:01
CWE-770
CWE-400
nodejs
web.nvd.nist.gov
183
cve-2019-5737
denial of service
http
https
node.js
vulnerability
nvd

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.6

Confidence

High

EPSS

0.013

Percentile

86.4%

JSON

In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.

Affected configurations

Nvd
Node
nodejsnode.jsRange6.0.0–6.17.0lts
OR
nodejsnode.jsRange8.0.0–8.15.1lts
OR
nodejsnode.jsRange10.0.0–10.15.2lts
OR
nodejsnode.jsRange11.0.0–11.10.1-
Node
opensuseleapMatch42.3
VendorProductVersionCPE
nodejsnode.js*cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
nodejsnode.js*cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
opensuseleap42.3cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "Node.js",
    "vendor": "Node.js",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 6.17.0"
      },
      {
        "status": "affected",
        "version": "All versions prior to 8.15.1"
      },
      {
        "status": "affected",
        "version": "All versions prior to 10.15.2"
      },
      {
        "status": "affected",
        "version": "All versions prior to 11.10.1"
      }
    ]
  }
]

Related

cvelist 2
nvd 2
ubuntucve 2
debiancve 2
osv 5
alpinelinux 2
prion 2
openvas 25
cbl_mariner 2
nessus 45
ibm 26
suse 6
veracode 2
altlinux 2
redhatcve 2
freebsd 2
redhat 5
nodejsblog 2
cve 1
oraclelinux 2
photon 4
centos 1
amazon 2
mageia 1
gentoo 1
ubuntu 1
f5 1
rocky 1
cvelist
cvelist
CVE-2019-5737
2019-03-28 16:20:28
CVE-2018-12121
2018-11-28 17:00:00
nvd
nvd
CVE-2019-5737
2019-03-28 17:29:01
CVE-2018-12121
2018-11-28 17:29:00
ubuntucve
ubuntucve
CVE-2019-5737
2019-03-28 00:00:00
CVE-2018-12121
2018-11-28 00:00:00
debiancve
debiancve
CVE-2019-5737
2019-03-28 17:29:01
CVE-2018-12121
2018-11-28 17:29:00
osv
osv
CVE-2019-5737
2019-03-28 17:29:01
CVE-2018-12121
2018-11-28 17:29:00
nodejs vulnerabilities
2021-03-15 21:18:37
alpinelinux
alpinelinux
CVE-2019-5737
2019-03-28 17:29:01
CVE-2018-12121
2018-11-28 17:29:00
prion
prion
Design/Logic Flaw
2019-03-28 17:29:00
Heap overflow
2018-11-28 17:29:00
openvas
openvas
openSUSE: Security Advisory for nodejs10 (openSUSE-SU-2019:1211-1)
2019-04-17 00:00:00
SUSE: Security Advisory (SUSE-SU-2019:0635-1)
2021-06-09 00:00:00
SUSE: Security Advisory (SUSE-SU-2019:0636-1)
2021-06-09 00:00:00
cbl_mariner
cbl_mariner
CVE-2019-5737 affecting package nodejs 8.11.4-7
2021-08-11 06:39:34
CVE-2018-12121 affecting package nodejs 8.11.4-7
2021-08-11 06:39:34
nessus
nessus
openSUSE Security Update : nodejs10 (openSUSE-2019-1211)
2019-04-17 00:00:00
SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2019:0627-1)
2019-03-19 00:00:00
SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2019:0635-1)
2019-03-20 00:00:00
ibm
ibm
Security Bulletin: A vulnerability in Node.js affects IBM Cloud App Management V2018
2019-09-06 12:28:35
Security Bulletin: IBM Cloud Transformation Advisor is affected by a Node.js denial of service vulnerability (CVE-2019-5737)
2022-12-05 19:00:57
Security Bulletin: IBM API Connect is affected by a denial of service vulnerability in Node.js (CVE-2019-5737)
2019-06-06 15:40:02
suse
suse
Security update for nodejs10 (moderate)
2019-04-16 00:00:00
Security update for nodejs6 (moderate)
2019-04-08 00:00:00
Security update for nodejs4 (moderate)
2019-03-28 00:00:00
veracode
veracode
Denial Of Service (DoS)
2019-03-04 05:31:23
Denial Of Service (DoS)
2018-11-30 05:36:43
altlinux
altlinux
Security fix for the ALT Linux 10 package node version 10.15.3-alt1
2019-03-09 00:00:00
Security fix for the ALT Linux 10 package node version 10.14.1-alt1
2018-11-30 00:00:00
redhatcve
redhatcve
CVE-2019-5737
2020-03-01 07:37:24
CVE-2018-12121
2019-10-28 21:36:22
freebsd
freebsd
Node.js -- multiple vulnerabilities
2019-02-28 00:00:00
node.js -- multiple vulnerabilities
2018-11-27 00:00:00
redhat
redhat
(RHSA-2019:1821) Important: rh-nodejs8-nodejs security update
2019-07-22 13:09:06
(RHSA-2019:3497) Moderate: http-parser security and bug fix update
2019-11-05 17:52:33
(RHSA-2019:2258) Moderate: http-parser security update
2019-08-06 08:17:52
nodejsblog
nodejsblog
February 2019 Security Releases
2019-02-28 00:00:00
November 2018 Security Releases
2018-11-28 00:00:00
cve
cve
CVE-2018-12121
2018-11-28 17:29:00
oraclelinux
oraclelinux
http-parser security and bug fix update
2019-11-14 00:00:00
http-parser security update
2019-08-13 00:00:00
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-2.0-0190
2019-11-20 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-1.0-0257
2019-11-20 00:00:00
Critical Photon OS Security Update - PHSA-2019-0190
2019-11-20 00:00:00
centos
centos
http security update
2019-09-18 20:20:44
amazon
amazon
Medium: http-parser
2019-10-21 18:01:00
Important: http-parser
2020-04-20 19:21:00
mageia
mageia
Updated nodejs packages fix security vulnerabilities
2019-09-15 16:24:16
gentoo
gentoo
Node.js: Multiple vulnerabilities
2020-03-20 00:00:00
ubuntu
ubuntu
Node.js vulnerabilities
2021-03-15 00:00:00
f5
f5
K000137090 : Node.js vulnerabilities CVE-2018-12121, CVE-2018-12122, and CVE-2018-12123
2023-10-02 00:00:00
rocky
rocky
nodejs:10 security update
2019-09-30 07:07:29

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.6

Confidence

High

EPSS

0.013

Percentile

86.4%

JSON
Related for CVE-2019-5737
cvelist2nvd2ubuntucve2debiancve2osv5alpinelinux2prion2openvas25cbl_mariner2nessus45ibm26suse6veracode2altlinux2redhatcve2freebsd2redhat5nodejsblog2cve1oraclelinux2photon4centos1amazon2mageia1gentoo1ubuntu1f51rocky1