CVE-2018-12121
Summary
| CVE | CVE-2018-12121 |
|---|---|
| State | PUBLISHED |
| Assigner | nodejs |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-11-28 17:29:00 UTC |
| Updated | 2026-10-08 22:16:44 UTC |
| Description | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Problem Types: CWE-400 | CWE-400 CWE-400: Uncontrolled Resource Consumption / Denial of Service
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 2.0 | [email protected] | Primary | 5 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
NoneAvailability
PartialAV:N/AC:L/Au:N/C:N/I:N/A:P
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | The Node.js Project | Node.js | affected All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Node.js: Multiple vulnerabilities (GLSA 202003-48) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | Third Party Advisory |
| Malformed Request | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| security.netapp.com/advisory/ntap-20241227-0008 | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| November 2018 Security Releases | Node.js | af854a3a-2127-422b-91ae-364da2661108 | nodejs.org | Patch, Vendor Advisory |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 296075 Oracle Solaris 11.4 Support Repository Update (SRU) 21.69.0 Missing (CPUAPR2020)
- 377509 Alibaba Cloud Linux Security Update for http-parser (ALINUX2-SA-2019:0063)
- 378150 Virtuozzo Linux Security Update for http-parser (VZLSA-2019:2258)
- 500432 Alpine Linux Security Update for nodejs
- 501095 Alpine Linux Security Update for nodejs-current
- 504195 Alpine Linux Security Update for nodejs
- 900064 CBL-Mariner Linux Security Update for nodejs 8.11.4
- 903050 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (4297)