Fluid Attacks Database

Description

All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	nodejs	>=0 <10.15.0~dfsg-6	10.15.0~dfsg-6
debian 14	nodejs	>=0 <10.15.0~dfsg-6	10.15.0~dfsg-6
debian 11	nodejs	>=0 <10.15.0~dfsg-6	10.15.0~dfsg-6
debian 13	nodejs	>=0 <10.15.0~dfsg-6	10.15.0~dfsg-6
npm	node	>=9.0.0 <9.11.2 \|\| >=10.0.0 <10.4.1	9.11.2, 10.4.1

Aliases

1. CVE-2018-71622. NVD-2018-71623. OSV-DEBIAN-2018-71624. OSV-2018-71625. GCVE-2018-71626. SECURITY-TRACKER-CVE-2018-71627. securityfocus.com8. nodejs.org9. security.gentoo.org

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.