CVE-2018-12122
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 41.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 41.29% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- nodejs/node.js · suse/suse enterprise storage · suse/suse linux enterprise server · suse/suse openstack cloud
- Source
- cve-request@iojs.org
References
- http://www.securityfocus.com/bid/106043Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:1821Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202003-48Third Party Advisory
- http://www.securityfocus.com/bid/106043Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:1821Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202003-48Third Party Advisory
- https://security.netapp.com/advisory/ntap-20241213-0009/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.