CVE-2018-7164CWE-400denial-of-service

CVE-2018-7164

High · published June 13, 2018

CVSS v3.1
7.5
EPSS
6%
Percentile
93.5
In the wild
Unconfirmed
What it is

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.06214 · 93.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2018-06-13T20:29Z
Affected products (2)
ProductVersionsFixed in
nodejs/node.js≥ 9.7.0, < 9.11.29.11.2
nodejs/node.js≥ 10.0.0, < 10.4.110.4.1
References (6)
http://www.securityfocus.com/bid/104463 · [email protected]https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ · [email protected]https://security.gentoo.org/glsa/202003-48 · [email protected]http://www.securityfocus.com/bid/104463 · af854a3a-2127-422b-91ae-364da2661108https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202003-48 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 13 JUN 16:00Z
    Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM
    cvelistv5