Denial of Service Vulnerability in Node.js: Slowloris Attack Risk
Summary
UBUNTU-CVE-2018-12122: Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connection... Affects nodejs versions 0.10.15~dfsg1-4 – 0.10.25~dfsg2-2ubuntu1.2+esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine, designed for building scalable network applications. It allows developers to use JavaScript for server-side scripting, enabling the creation of dynamic web pages. The affected versions of Node.js are vulnerable to a Slowloris HTTP Denial of Service (DoS) attack, which can exhaust server resources and disrupt service availability.
Vulnerability Detail
The vulnerability, identified as CVE-2018-12122, affects all versions of Node.js prior to 6.15.0, 8.14.0, 10.14.0, and 11.3.0. An attacker can exploit this vulnerability by sending HTTP headers at a very slow rate, keeping connections alive for an extended period. This can lead to resource exhaustion on the server, resulting in a denial of service where legitimate users are unable to access the application. The severity of this vulnerability is rated with a CVSS score of 7.5, indicating a high risk to affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing rate limiting on your server to mitigate the effects of the Slowloris attack. This can be done by configuring your web server to limit the number of connections from a single IP address or by setting a timeout for idle connections.
Conclusion
The CVE-2018-12122 vulnerability in Node.js poses a significant risk of denial of service through Slowloris attacks. It is essential for users of affected versions to upgrade to the latest patched versions to ensure the security and availability of their applications. Implementing rate limiting can serve as a temporary measure while preparing for the upgrade.
See every vulnerability recorded for nodejs →
FAQ
A Slowloris attack is a type of denial-of-service attack that aims to keep many connections to the target web server open and hold them open as long as possible. This is done by sending partial HTTP requests and never completing them.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
If left unaddressed, this vulnerability can lead to service outages, affecting user experience and potentially causing financial losses due to downtime.
Yes, you should upgrade to at least version 6.15.0, 8.14.0, 10.14.0, or 11.3.0 to mitigate this vulnerability.
Yes, implementing rate limiting on your server can serve as a temporary workaround to reduce the impact of a Slowloris attack until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
