Denial of Service Vulnerability in Node.js - CVE-2019-5737
Summary
ALPINE-CVE-2019-5737: In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and... Affects nodejs versions < 10.15.3-r0. Fixed in 10.15.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source, cross-platform JavaScript runtime environment that executes JavaScript code outside a web browser. It is widely used for building scalable network applications. The package 'nodejs' is integral to many applications, providing the runtime for server-side JavaScript. However, it is susceptible to vulnerabilities that can lead to service disruptions, such as the Denial of Service (DoS) vulnerability identified as CVE-2019-5737.
Vulnerability Detail
In Node.js versions prior to 6.17.0, 8.15.1, 10.15.2, and 11.10.1, an attacker can exploit a Denial of Service (DoS) vulnerability by establishing an HTTP or HTTPS connection in keep-alive mode and sending headers very slowly. This method keeps the connection and associated resources alive for an extended period, potentially overwhelming the server. This vulnerability is an extension of CVE-2018-12121 and affects all active Node.js release lines.
How To Fix
Minimum fixed version
10.15.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing a load balancer or proxy layer to mitigate the effects of this vulnerability. This can help distribute incoming traffic and reduce the risk of service disruption.
Conclusion
CVE-2019-5737 represents a significant vulnerability in Node.js that can lead to Denial of Service attacks. It is crucial for users to update their Node.js installations to the patched version to safeguard against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
CVE-2019-5737 is a Denial of Service vulnerability in Node.js that allows an attacker to keep connections alive by sending headers slowly, potentially overwhelming the server.
Node.js versions prior to 6.17.0, 8.15.1, 10.15.2, and 11.10.1 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The CVSS score for CVE-2019-5737 is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing a load balancer or proxy to mitigate the risk of a DoS attack.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
