CVE-2017-14919: Input Validation
Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.
Other sources
Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version) if you call zlib.createDeflateRaw({windowBits: 8}).
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.5Fixed in 6.11.5Fixed in 8.8.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.8.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.11.5 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 4.8.5 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 6.11.5 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 8.8.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2017-14919?
CVE-2017-14919 has a severity rating of high due to its potential to cause a denial of service.
How do I fix CVE-2017-14919?
To fix CVE-2017-14919, upgrade Node.js to version 4.8.5, 6.11.5, or 8.8.0 or later.
Which versions of Node.js are affected by CVE-2017-14919?
CVE-2017-14919 affects Node.js versions 4.8.2 to 4.8.4, 6.x before 6.11.5, and 8.x before 8.8.0.
Is CVE-2017-14919 a remote vulnerability?
Yes, CVE-2017-14919 allows remote attackers to exploit the vulnerability.
What type of attack does CVE-2017-14919 enable?
CVE-2017-14919 enables attackers to cause a denial of service through uncaught exceptions leading to crashes.