CVE-2019-5737
Fixed in a distro release EPSS 16%
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
Products: Node.js
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | nodejs | 10.15.3-r0 |
| Alpine 3.11 | nodejs | 10.15.3-r0 |
| Alpine 3.12 | nodejs | 10.15.3-r0 |
| Alpine 3.13 | nodejs | 10.15.3-r0 |
| Alpine 3.14 | nodejs | 10.15.3-r0 |
| Alpine 3.15 | nodejs | 10.15.3-r0 |
| Alpine 3.16 | nodejs | 10.15.3-r0 |
| Alpine 3.17 | nodejs | 10.15.3-r0 |
| Alpine 3.18 | nodejs | 10.15.3-r0 |
| Alpine 3.19 | nodejs | 10.15.3-r0 |
| Alpine 3.20 | nodejs | 10.15.3-r0 |
| Alpine 3.21 | nodejs | 10.15.3-r0 |
| Alpine 3.22 | nodejs | 10.15.3-r0 |
| Alpine 3.23 | nodejs | 10.15.3-r0 |
| Alpine 3.24 | nodejs | 10.15.3-r0 |
| Alpine 3.9 | nodejs | 10.15.3-r0 |
| Debian 12 | nodejs | 10.15.2~dfsg-1 |
| Debian 13 | nodejs | 10.15.2~dfsg-1 |
| Debian 14 | nodejs | 10.15.2~dfsg-1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-devel-debuginfo | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8+2632+6c5111ed |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:17-3.module+el8+2873+aa7dfd9a |
| Red Hat Enterprise Linux 8 | npm | 1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda |
| Red Hat rhel software collections 3 | rh-nodejs10 | 0:3.2-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs | 0:10.16.3-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-debuginfo | 0:10.16.3-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-devel | 0:10.16.3-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-docs | 0:10.16.3-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-npm | 0:6.9.0-10.16.3.3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-runtime | 0:3.2-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-scldevel | 0:3.2-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs | 0:8.16.0-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs-debuginfo | 0:8.16.0-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs-devel | 0:8.16.0-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs-docs | 0:8.16.0-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-npm | 0:6.4.1-8.16.0.1.el7 |
| Rocky Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
| Rocky Linux 8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
| SUSE Enterprise Storage 4 | nodejs4 | 4.9.1-15.20.1 |
| SUSE Enterprise Storage 4 | nodejs6 | 6.17.0-11.24.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs10 | 10.15.2-1.6.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs4 | 4.9.1-15.20.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs6 | 6.17.0-11.24.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 | nodejs10 | 10.15.2-1.6.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 | nodejs8 | 8.15.1-3.14.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox | 68.2.0-78.51.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox-branding-SLED | 68-21.9.8 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-atk | 2.26.1-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-cairo | 1.15.10-2.13.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gdk-pixbuf | 2.36.11-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-glib2 | 2.54.3-2.14.7 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gtk3 | 3.10.9-2.15.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-harfbuzz | 1.7.5-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi | 3.2.1.git259-2.3.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-pango | 1.40.14-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nspr | 4.21-29.6.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nss | 3.45-38.9.3 |
| SUSE OpenStack Cloud 7 | nodejs6 | 6.17.0-11.24.1 |
| SUSE OpenStack Cloud Crowbar 8 | nodejs6 | 6.17.0-11.24.1 |
| Ubuntu Pro 14.04 LTS | nodejs | 0.10.25~dfsg2-2ubuntu1.2+esm1 |
| Ubuntu Pro 16.04 LTS | nodejs | no fix |
| Ubuntu Pro 16.04 LTS | nodejs | 4.2.6~dfsg-1ubuntu4.2+esm1 |
| Ubuntu Pro 18.04 LTS | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm1 |