CVE-2019-5739CWE-400

Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier

published March 28, 2019

CVSS
—
EPSS
5%
Percentile
92.1
In the wild
Unconfirmed
What it is

Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04929 · 92.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2019-03-28T16:27Z
EPSS history
Timeline
  • 28 MAR 16:27Z
    Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier
    cvelistv5