In Node.js including 6.x before 6.17.0 8.x before 8.15.1 10.x before 10.15.2 and 11.x before 11.10.1 an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121 addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0 8.x before 8.15.1 10.x before 10.15.2 and 11.x before 11.10.1.

🗓️ 06 Jun 2021 07:00:00Reported by MicrosoftType

Node.js versions prior to affected ranges are vulnerable to DoS from slow keep-alive HTTP headers; mitigated by proxies.

Reporter	Title	Published	Views	Family All 230
IBM Security Bulletins	Security Bulletin: A vulnerability in Node.js affects IBM Cloud App Management V2018	6 Sep 201912:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private - Node.js	11 Mar 201914:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect has addressed multiple vulnerabilities in Developer Portal's dependencies - Cumulative list from June 28, 2018 to December 13, 2018	28 Jan 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management V2018	13 May 201923:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM Cloud Private (CVE-2019-5739 CVE-2019-5737 CVE-2019-1559)	2 Jul 201917:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software	29 Jan 201921:10	–	ibm
IBM Security Bulletins	Security Bulletin: API Connect is impacted by multiple nodeJS vulnerabilities (CVE-2018-12122 CVE-2018-12121 CVE-2018-12123 CVE-2018-12116)	27 Mar 201922:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by Node.js vulnerabilities	29 Mar 201910:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by vulnerabilities in the shipped Node runtime	29 Mar 201910:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud Transformation Advisor	5 Dec 202219:00	–	ibm

Vulners

Node

microsoft cm1_nodejs_14.17.2-1Range<14.17.2-1

06 Jun 2021 07:00Current

9.3High risk

Vulners AI Score9.3

CVSS 25

CVSS 3.17.5

EPSS0.26351