In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of…

Description

In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.

Scores

EPSS (exploitation in 30 days)

16.2% · top 3.0% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-400: Uncontrolled Resource Consumption / Denial of Service (opens in a new tab)All about CWE-400 and its CVEs
• CWE-770 (opens in a new tab)All about CWE-770 and its CVEs

Affected products

• Node.js · Node.js

  • affected All versions prior to 6.17.0
  • affected All versions prior to 8.15.1
  • affected All versions prior to 10.15.2
  • affected All versions prior to 11.10.1

References (7)

• https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/ (opens in a new tab)x_refsource_MISCx_transferred
• openSUSE-SU-2019:1076 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• openSUSE-SU-2019:1173 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• openSUSE-SU-2019:1211 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• https://security.netapp.com/advisory/ntap-20190502-0008/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• RHSA-2019:1821 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• GLSA-202003-48 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-5737](https://trackcve.app/badge/CVE-2019-5737.svg)](https://trackcve.app/cve/CVE-2019-5737)

Record last updated 4 Aug 2024, 20:01 UTC.