CVE-2019-5739
Fixed in a distro release EPSS 5%
Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.
Products: Node.js
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | nodejs | 8.9.3~dfsg-5 |
| Debian 13 | nodejs | 8.9.3~dfsg-5 |
| Debian 14 | nodejs | 8.9.3~dfsg-5 |
| SUSE Enterprise Storage 4 | nodejs4 | 4.9.1-15.20.1 |
| SUSE Enterprise Storage 4 | nodejs6 | 6.17.0-11.24.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs4 | 4.9.1-15.20.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs6 | 6.17.0-11.24.1 |
| SUSE OpenStack Cloud 7 | nodejs6 | 6.17.0-11.24.1 |
| SUSE OpenStack Cloud Crowbar 8 | nodejs6 | 6.17.0-11.24.1 |
| Ubuntu Pro 16.04 LTS | nodejs | no fix |