Denial of Service Vulnerability in nodejs
Summary
CVE-2019-9518: Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. Affects nodejs across 2 version ranges.
< 10.16.3-r0
>= f6fc46e03674ab1896792b7363ecac0665b5e0c5, < eb66efd6052801e2f10360c51787569da0185808
Fixed in 10.16.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine. It is designed to build scalable network applications and is widely used for server-side and networking applications. However, certain versions of Node.js are vulnerable to a Denial of Service (DoS) attack due to a flaw in the HTTP/2 implementation.
Vulnerability Detail
The vulnerability, identified as CVE-2019-9518, allows an attacker to flood the target system with a stream of empty frames without the end-of-stream flag. These frames can be of various types, including DATA, HEADERS, CONTINUATION, and PUSH_PROMISE. As a result, the target system spends excessive CPU time processing each frame, leading to a potential DoS condition. This can result in service disruption and unavailability.
How To Fix
Minimum fixed version
10.16.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the Node.js package to the patched version.
Conclusion
The Denial of Service vulnerability in Node.js can be mitigated by updating the affected package to version 10.16.3-r0 or later. It is crucial to apply this fix to prevent potential service disruption and ensure the availability of your Node.js applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
The vulnerability can lead to a DoS condition, causing service disruption and unavailability.
The vulnerability affects Node.js versions prior to 10.16.3-r0.
At the time of this report, there is no known public exploit for this vulnerability.
The recommended mitigation is to update the Node.js package to version 10.16.3-r0 or later.
You can find more information about this vulnerability in the official CVE-2019-9518 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
