CVE-2015-8027: High severity Nodejs Node.js vulnerability
A bug whereby an HTTP socket may no longer have a parser associated with it but a pipelined request attempts to trigger a pause or resume on the non-existent parser, a potential denial-of-service vulnerability.
Other sources
Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.3Fixed in 5.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8027?
CVE-2015-8027 is classified as a denial of service vulnerability.
How do I fix CVE-2015-8027?
To fix CVE-2015-8027, upgrade Node.js to version 0.12.9 or later, 4.2.3 or later, or 5.1.1 or later.
What versions of Node.js are affected by CVE-2015-8027?
Node.js versions 0.12.0 through 0.12.8, 4.0.x before 4.2.3, and 5.0.x before 5.1.1 are affected by CVE-2015-8027.
Can CVE-2015-8027 lead to data loss?
CVE-2015-8027 primarily leads to service outage and does not directly cause data loss.
Who is impacted by CVE-2015-8027?
Any services using the affected versions of Node.js are at risk of denial of service due to CVE-2015-8027.