Denial of Service Vulnerability in Node.js - CVE-2017-14919
Summary
ALPINE-CVE-2017-14919: Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value... Affects nodejs versions < 6.11.5-r0. Fixed in 6.11.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The package 'nodejs' is essential for running JavaScript applications outside the browser. However, certain versions of Node.js are vulnerable to a denial of service attack due to a flaw in the zlib module, which can lead to application crashes.
Vulnerability Detail
The vulnerability identified as CVE-2017-14919 affects Node.js versions prior to 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0. It allows remote attackers to exploit a change in the zlib module (version 1.2.9) that makes the value '8' an invalid parameter for 'windowBits'. This can result in uncaught exceptions and crashes, leading to denial of service. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
6.11.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing input validation to restrict the values passed to the zlib module, or use a different version of Node.js that is not affected by this vulnerability.
Conclusion
CVE-2017-14919 is a significant vulnerability in Node.js that can lead to denial of service attacks. It is crucial for developers to update their Node.js installations to the patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
CVE-2017-14919 is a vulnerability in Node.js that allows remote attackers to cause a denial of service by exploiting a flaw in the zlib module.
Node.js versions before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update Node.js immediately, consider implementing input validation to restrict the values passed to the zlib module as a temporary workaround.
The CVSS score of CVE-2017-14919 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
