Denial of Service Vulnerability in Node.js - CVE-2018-12122
Summary
ALPINE-CVE-2018-12122: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connection... Affects nodejs versions < 10.14.0-r0. Fixed in 10.14.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The package 'nodejs' is essential for running JavaScript applications and provides a rich ecosystem of libraries and frameworks. However, it has been found to be vulnerable to a Denial of Service (DoS) attack due to its handling of HTTP requests, particularly when headers are sent slowly.
Vulnerability Detail
The vulnerability identified as CVE-2018-12122 affects all versions of Node.js prior to 6.15.0, 8.14.0, 10.14.0, and 11.3.0. It allows an attacker to exploit the Slowloris technique, which involves sending HTTP headers at a very slow rate. This keeps the HTTP or HTTPS connections open for an extended period, consuming server resources and potentially leading to a denial of service. The ramifications of this vulnerability can be severe, as it may render the affected server unresponsive to legitimate requests, impacting availability and user experience.
How To Fix
Minimum fixed version
10.14.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on your server to mitigate the effects of slow HTTP requests. This can be done by configuring your web server to limit the number of connections from a single IP address or by using middleware in your application to reject requests that exceed a certain threshold.
Conclusion
CVE-2018-12122 is a significant vulnerability in Node.js that can lead to Denial of Service attacks. It is crucial for users to update their installations to the latest patched versions to protect against this threat. Implementing workarounds such as rate limiting can provide temporary relief until updates are applied.
See every vulnerability recorded for nodejs →
FAQ
CVE-2018-12122 is a vulnerability in Node.js that allows attackers to perform a Denial of Service (DoS) attack by sending HTTP headers slowly.
All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0, and 11.3.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2018-12122 is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing rate limiting as a workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
