Description
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Node.js Project | Node.js | All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nodejs | 10.15.0~dfsg-6 | — |
| Debian 13 | nodejs | 10.15.0~dfsg-6 | — |
| Debian 12 | nodejs | 10.15.0~dfsg-6 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 16.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 14.04 LTS | nodejs | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | http-parser | 2.8.0-5.el8 | RHSA-2019:3497 |
| RHEL 7 | http-parser +1 | 2.7.1-8.el7 | RHSA-2019:2258 |
| RHEL 3 | rh-nodejs10 +2 | 3.2-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-nodejs +2 | 10.16.3-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-npm | 6.9.0-10.16.3.3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.16.0-1.el7 | RHSA-2019:1821 |
| RHEL 3 | rh-nodejs8-npm | 6.4.1-8.16.0.1.el7 | RHSA-2019:1821 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | nodejs8 | 8.15.0-3.11.1 | SUSE-SU-2019:0118-1 |
| SLES 12 | nodejs4 | 4.9.1-15.17.1 | SUSE-SU-2019:0117-1 |
| SLES 12 | nodejs6 | 6.16.0-11.21.1 | SUSE-SU-2019:0395-1 |
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 8 | nodejs6 | 6.16.0-11.21.1 | SUSE-SU-2019:0395-1 |
| SUSE OpenStack Cloud 7 | nodejs6 | 6.16.0-11.21.1 | SUSE-SU-2019:0395-1 |
| SUSE Enterprise Storage 4 | nodejs4 | 4.9.1-15.17.1 | SUSE-SU-2019:0117-1 |
| SUSE Enterprise Storage 4 | nodejs6 | 6.16.0-11.21.1 | SUSE-SU-2019:0395-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.0 | nodejs8 | 8.15.0-lp150.2.9.1 | openSUSE-SU-2019:0089-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nodejs | 10.14.0-r0 | — |
| Alpine v3.24 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.23 | nodejs | 10.14.0-r0 | — |
| Alpine v3.23 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.22 | nodejs | 10.14.0-r0 | — |
| Alpine v3.22 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.21 | nodejs | 10.14.0-r0 | — |
| Alpine v3.21 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.20 | nodejs | 10.14.0-r0 | — |
| Alpine v3.20 | nodejs-current | 11.3.0-r0 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nodejs | 10.14.0-r0 | — |
| Alpine v3.19 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.18 | nodejs | 10.14.0-r0 | — |
| Alpine v3.18 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.17 | nodejs | 10.14.0-r0 | — |
| Alpine v3.17 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.16 | nodejs | 10.14.0-r0 | — |
| Alpine v3.16 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.15 | nodejs | 10.14.0-r0 | — |
| Alpine v3.15 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.14 | nodejs | 10.14.0-r0 | — |
| Alpine v3.14 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.13 | nodejs | 10.14.0-r0 | — |
| Alpine v3.13 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.12 | nodejs | 10.14.0-r0 | — |
| Alpine v3.12 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.11 | nodejs | 10.14.0-r0 | — |
| Alpine v3.11 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.10 | nodejs | 10.14.0-r0 | — |
| Alpine v3.10 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.9 | nodejs | 10.14.0-r0 | — |
| Alpine v3.9 | nodejs-current | 11.3.0-r0 | — |
| Alpine v3.8 | nodejs | 8.14.0-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | http-parser +1 | 2.7.1-8.amzn2 | ALAS2-2019-1322 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | http-parser | 2.8.0-5.el8 | ELSA-2019-3497 |
| Oracle Linux 7 | http-parser +1 | 2.7.1-8.el7 | ELSA-2019-2258 |
Advisories 14
- WID-SEC-2022-0517 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2019:2939 Red Hat Security Advisory: rh-nodejs10-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:3497 Red Hat Security Advisory: http-parser security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:2258 Red Hat Security Advisory: http-parser security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2019:1821 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- SUSE-SU-2019:0118-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0395-1 Security update for nodejs6 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0117-1 Security update for nodejs4 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:0089-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2535 Red Hat rh-nodejs8-nodejs: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 3, 2023
- ELSA-2019-3497 Moderate: http-parser security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 14, 2019
- ALAS2-2019-1322 Moderate: http-parser security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 23, 2019
- ELSA-2019-2258 Moderate: http-parser security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 13, 2019
References
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
- 106043 vdb-entry
- RHSA-2019:1821 vendor-advisory
- RHSA-2019:2258 vendor-advisory
- RHSA-2019:3497 vendor-advisory
- GLSA-202003-48 vendor-advisory