CVE-2018-7162

nodejs: denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash

Loading…

Severity

Moderate

Red Hat Product Security

7.5

CVSS 3.0

Review impact separately from score.

Published · June 12, 2018

Updated · October 9, 2026

Description

All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 · Use After Free