CVE-2018-7161: Input Validation
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7161?
The severity of CVE-2018-7161 is rated as HIGH.
How do I fix CVE-2018-7161?
To fix CVE-2018-7161, upgrade Node.js to version 8.11.3 or higher, 9.11.2 or higher, or 10.4.1 or higher.
What versions of Node.js are affected by CVE-2018-7161?
CVE-2018-7161 affects Node.js versions 8.x up to 8.11.2, all 9.x versions up to 9.11.1, and all 10.x versions up to 10.4.0.
What type of attack does CVE-2018-7161 enable?
CVE-2018-7161 allows an attacker to cause a denial of service (DoS) by crashing a node server that provides an http2 server.
Is there any workaround for CVE-2018-7161?
There is no official workaround for CVE-2018-7161 other than upgrading to a vulnerable-free version of Node.js.