Denial of Service Vulnerability in Node.js due to Improper Input Validation in nghttp2
Summary
ALPINE-CVE-2018-1000168: nghttp2 version >= 1.10.0 and nghttp2. Affects nodejs versions < 8.11.3-r0. Fixed in 8.11.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine, enabling developers to build scalable network applications. It is widely used for server-side development and is known for its event-driven, non-blocking I/O model. The vulnerability in question affects the nghttp2 library, which is utilized by Node.js for HTTP/2 support. This specific vulnerability can lead to a denial of service, impacting the availability of applications relying on Node.js.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000168, arises from improper input validation in the ALTSVC frame handling of nghttp2 versions >= 1.10.0 and <= 1.31.0. This flaw can result in a segmentation fault, leading to a denial of service. Attackers can exploit this vulnerability via network clients, potentially causing significant disruptions to services that depend on Node.js. The issue has been addressed in nghttp2 version 1.31.1 and later.
How To Fix
Minimum fixed version
8.11.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the exposure of your application by implementing network-level controls, such as firewalls or rate limiting, to reduce the risk of exploitation until the package is updated.
Conclusion
In summary, CVE-2018-1000168 is a significant vulnerability affecting Node.js through the nghttp2 library, leading to potential denial of service. It is crucial to update to the patched version to ensure the security and availability of applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
CVE-2018-1000168 is a vulnerability in the nghttp2 library used by Node.js, which can lead to a denial of service due to improper input validation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to a segmentation fault in applications using affected versions of nghttp2, resulting in denial of service and potential downtime.
Yes, the vulnerability has been fixed in nghttp2 version 1.31.1 and later. Updating to Node.js version 8.11.3-r0 on Alpine Linux will resolve the issue.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software by analyzing a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
