CVE-2018-7161CWE-20

CVE-2018-7161

High · published June 13, 2018

CVSS v3.1

7.5

EPSS

Percentile

94.5

In the wild

Unconfirmed

What it is

All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.07485 · 94.5th percentile
Weakness: CWE-20 · Improper Input Validation
Published: 2018-06-13T20:29Z

Affected products (4)

Product	Versions	Fixed in
nodejs/node.js	≥ 8.0.0, ≤ 8.8.1	—
nodejs/node.js	≥ 8.9.0, < 8.11.3	8.11.3
nodejs/node.js	≥ 9.0.0, < 9.11.2	9.11.2
nodejs/node.js	≥ 10.0.0, < 10.4.1	10.4.1

References (6)

http://www.securityfocus.com/bid/106363 · [email protected]https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ · [email protected]https://security.gentoo.org/glsa/202003-48 · [email protected]http://www.securityfocus.com/bid/106363 · af854a3a-2127-422b-91ae-364da2661108 https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ · af854a3a-2127-422b-91ae-364da2661108 https://security.gentoo.org/glsa/202003-48 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

13 JUN 16:00Z
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH
cvelistv5