All versions of Node.js 8.x 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.

🗓️ 06 Jun 2021 00:00:00Reported by MicrosoftType

All Node.js eight, nine, and ten are DoS vulnerable due to an http two server crash from a cleanup bug, fixed by updating the http two implementation.

Reporter	Title	Published	Views	Family All 107
ALT Linux	Security fix for the ALT Linux 10 package node version 8.11.3-alt1	30 Jun 201800:00	–	altlinux
IBM Security Bulletins	Security Bulletin: IBM API Connect has addressed multiple vulnerabilities in Developer Portal's dependencies - Cumulative list from June 28, 2018 to December 13, 2018	28 Jan 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affects IBM Rational Application Developer for WebSphere Software included in Rational Developer for i	27 Nov 201816:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private and IBM Cloud Private Cloud Foundry (CVE-2018-7167, CVE-2018-7164, CVE-2018-7162, CVE-2018-1000168, CVE-2018-7161)	26 Sep 201818:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Integration Bus & IBM App Connect Enterprise V11	20 Nov 201812:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud	11 Sep 201818:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is affected by multiple third-party vulnerabilities (Node.js, nghttp2, Linux, Intel CPU, Android)	31 Oct 201820:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software (CVE-2018-1000168, CVE-2018-7161)	12 Nov 201816:15	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and Business Process Manager (BPM)	15 Sep 202219:20	–	ibm
IBM Security Bulletins	Security Bulletin: Node.js as used in IBM QRadar Packet Capture is susceptible to multiple vulnerabilities	7 Nov 201815:25	–	ibm

Vulners

Node

microsoft cm1_nodejs_14.17.2-1Range<14.17.2-1

06 Jun 2021 00:00Current

9.3High risk

Vulners AI Score9.3

CVSS 3.17.5

CVSS 27.8

EPSS0.07855