Node.js Slowloris HTTP Denial of Service (CVE-2018-12122)
Summary
CVE-2018-12122: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connection... Affects nodejs across 2 version ranges.
< 10.14.0-r0
>= ce3e3c5fe15479475c068482c48eb9cbf1ac9df5, < cde64500277d7697743e772575738c8415c7d6ab
Fixed in 10.14.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications using JavaScript on the server-side. The package 'nodejs' in the Alpine Linux distribution is affected by a vulnerability known as Slowloris HTTP Denial of Service (CVE-2018-12122). This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending headers very slowly, keeping HTTP or HTTPS connections and associated resources alive for a long period of time.
Vulnerability Detail
The Slowloris HTTP Denial of Service vulnerability in Node.js allows an attacker to exhaust server resources by sending headers slowly, thereby keeping connections open for an extended period. This can lead to a DoS situation where legitimate users are unable to access the server. The vulnerability affects all versions of Node.js prior to versions 6.15.0, 8.14.0, 10.14.0, and 11.3.0. By exploiting this vulnerability, an attacker can disrupt the availability of a Node.js server, potentially causing financial loss or reputational damage.
How To Fix
Minimum fixed version
10.14.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the 'nodejs' package to the fixed version as mentioned in the 'how_to_fix' section.
Conclusion
The Slowloris HTTP Denial of Service vulnerability in Node.js can have severe consequences, leading to a DoS situation and the unavailability of the server. It is crucial to update the 'nodejs' package to the fixed version to mitigate this vulnerability. Regularly updating Node.js and its dependencies is essential to ensure the security of your server. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Slowloris is a type of Denial of Service (DoS) attack that aims to keep a server's resources tied up for as long as possible by sending headers slowly. This can lead to a situation where legitimate users are unable to access the server.
All versions of Node.js prior to versions 6.15.0, 8.14.0, 10.14.0, and 11.3.0 are affected by this vulnerability.
By exploiting this vulnerability, an attacker can cause a Denial of Service (DoS) situation, leading to the unavailability of the Node.js server. This can result in financial loss or reputational damage.
To fix this vulnerability, update the 'nodejs' package to version 10.14.0-r0 or later. Refer to the 'how_to_fix' section for detailed instructions.
No, there is no known workaround for this vulnerability. It is recommended to update the 'nodejs' package to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
