CVE-2017-18353: Vulnerability in rendertron
Summary
CVE-2017-18353: rendertron can remotely shut down Chrome instance. Affects rendertron versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rendertron is an npm package that provides server-side rendering of JavaScript-driven web applications. It utilizes a headless Chrome browser to render web pages and return static HTML content. This vulnerability affects Rendertron version 1.0.0. The package includes an _ah/stop route that can be used to shut down the Chrome instance responsible for serving render requests to all users. Exploiting this vulnerability allows unauthorized remote attackers to disable the core service of the application.
Vulnerability Detail
The vulnerability in Rendertron version 1.0.0 arises from the presence of the _ah/stop route, which can be accessed with a GET request. By visiting this route, an attacker can trigger the shutdown of the Chrome instance used for rendering web pages. This can lead to a denial-of-service (DoS) situation, where the application becomes unavailable to all users. The impact of this vulnerability can be severe, as it can disrupt the normal functioning of the application and potentially cause financial losses or reputational damage. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 3.1.0 as of 22 Oct 2026
npm install rendertron@3.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.0
This is the first release that contains the fix.
npm install rendertron@1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by manually removing or disabling the _ah/stop route in the Rendertron codebase. This can be achieved by modifying the relevant route configuration or commenting out the corresponding code block. However, it is strongly recommended to apply the official fix by upgrading to a secure version as soon as possible.
Conclusion
The vulnerability in Rendertron version 1.0.0 allows unauthorized remote attackers to disable the core service of the application, leading to a denial-of-service (DoS) situation. To mitigate this vulnerability, it is recommended to upgrade to a fixed version (1.1.0 or later) or apply a temporary workaround by removing or disabling the _ah/stop route. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rendertron →
FAQ
Rendertron is an npm package that enables server-side rendering of JavaScript-driven web applications. It uses a headless Chrome browser to render web pages and return static HTML content.
Exploiting this vulnerability allows unauthorized remote attackers to disable the core service of the application, leading to a denial-of-service (DoS) situation. This can result in the application becoming unavailable to all users.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Rendertron (1.1.0 or later). This will remove the _ah/stop route and prevent unauthorized access to the shutdown functionality.
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by manually removing or disabling the _ah/stop route in the Rendertron codebase.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for rendertron.
