Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.

🗓️ 06 Jun 2021 00:00:00Reported by MicrosoftType

Node.js 9.7.0+ and 10.x have a medium severity memory DoS in net.Socket streams from tiny chunks; fixed by reverting to prior behavior.

Reporter	Title	Published	Views	Family All 26
FreeBSD	node.js -- multiple vulnerabilities	12 Jun 201800:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private and IBM Cloud Private Cloud Foundry (CVE-2018-7167, CVE-2018-7164, CVE-2018-7162, CVE-2018-1000168, CVE-2018-7161)	26 Sep 201818:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud	11 Sep 201818:41	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and Business Process Manager (BPM)	15 Sep 202219:20	–	ibm
CBLMariner	CVE-2018-7164 affecting package nodejs 8.11.4-7	11 Aug 202106:39	–	cbl_mariner
CNVD	Node.js Denial of Service Vulnerability (CNVD-2018-11811)	14 Jun 201800:00	–	cnvd
CVE	CVE-2018-7164	13 Jun 201816:00	–	cve
Cvelist	CVE-2018-7164	13 Jun 201816:00	–	cvelist
Debian CVE	CVE-2018-7164	13 Jun 201816:00	–	debiancve
EUVD	EUVD-2018-18906	7 Oct 202500:30	–	euvd