p PatchFirst

CVE-2018-7162

CVE-2018-7162

This page contains facts from public vulnerability sources. Check the original advisory before updating.

All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.

CVSS 7.5 · High · EPSS 6.6% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node.js

    Versions
    • 9.x+: Affected
    • 10.x+: Affected

    No fix published

  • nodejs Debian:12

    Affected ranges
    • ECOSYSTEM: < 10.15.0~dfsg-6

    Update to 10.15.0~dfsg-6

  • nodejs Debian:13

    Affected ranges
    • ECOSYSTEM: < 10.15.0~dfsg-6

    Update to 10.15.0~dfsg-6

  • nodejs Debian:14

    Affected ranges
    • ECOSYSTEM: < 10.15.0~dfsg-6

    Update to 10.15.0~dfsg-6

Original sources

Check your server →