Denial of Service with large HTTP headers in Node.js
Summary
CVE-2018-12121: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and... Affects nodejs across 2 version ranges.
< 10.14.0-r0
>= ce3e3c5fe15479475c068482c48eb9cbf1ac9df5, < b6589e3d9be963b29a8559bf7b272b54284fe1bc
Fixed in 10.14.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications. However, prior to Node.js versions 6.15.0, 8.14.0, 10.14.0, and 11.3.0, there is a vulnerability that can lead to a Denial of Service (DoS) attack. This vulnerability arises from the handling of large HTTP headers by the Node.js HTTP server.
Vulnerability Detail
The vulnerability, identified as CVE-2018-12121, can be exploited by sending a combination of many requests with maximum-sized headers (almost 80 KB per connection) and carefully timed completion of the headers. This can cause the HTTP server to abort due to heap allocation failure. The attack potential can be mitigated by using a load balancer or other proxy layer.
How To Fix
Minimum fixed version
10.14.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Node.js is not immediately feasible, a workaround is to use a load balancer or proxy layer in front of the Node.js server. This can help mitigate the impact of the DoS attack by handling the large HTTP headers before they reach the vulnerable Node.js server.
Conclusion
In conclusion, the Denial of Service vulnerability in Node.js can be mitigated by updating to the recommended versions or using a load balancer/proxy layer. It is important to stay updated with security patches and regularly check for vulnerabilities in your software. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
The vulnerability can lead to a Denial of Service (DoS) attack, causing the Node.js HTTP server to abort due to heap allocation failure.
All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0, and 11.3.0 are affected.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
Yes, the CVSS score for this vulnerability is 7.5.
You can find more information about this vulnerability in the CVE-2018-12121 JSON report (https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12121.json).
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
