CVE-2018-7161 is a high-severity denial-of-service vulnerability affecting Node.js versions 8.x, 9.x, and 10.x. An unauthenticated attacker can crash an http2 server by exploiting a cleanup bug in native code, leading to a denial of service. The vulnerability has a CVSS score of 7.5 and is easily exploitable over the network with low attack complexity. While no public exploit code or active exploitation has been observed, and community discussion is minimal, affected systems should be updated to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.0.0, <= 8.8.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 8.9.0, < 8.11.3CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | ||
>= 9.0.0, < 9.11.2CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 10.0.0, < 10.4.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
All versions of Node.js 8.x 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.
Jun 12, 2018nodejs: denial of service (DoS) by causing a node server providing an http2 server to crash
Jun 12, 2018