CVE-2018-7161: Denial of Service Vulnerability in HTTP/2
All versions of 8.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation. Thanks to Jordan Zebor at F5 Networks for reporting this issue.
Other sources
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.3Fixed in 9.11.2Fixed in 10.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.11.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-7161?
The severity of CVE-2018-7161 is rated as HIGH.
How do I fix CVE-2018-7161?
To fix CVE-2018-7161, upgrade Node.js to version 8.11.3 or higher, 9.11.2 or higher, or 10.4.1 or higher.
What versions of Node.js are affected by CVE-2018-7161?
CVE-2018-7161 affects Node.js versions 8.x up to 8.11.2, all 9.x versions up to 9.11.1, and all 10.x versions up to 10.4.0.
What type of attack does CVE-2018-7161 enable?
CVE-2018-7161 allows an attacker to cause a denial of service (DoS) by crashing a node server that provides an http2 server.
Is there any workaround for CVE-2018-7161?
There is no official workaround for CVE-2018-7161 other than upgrading to a vulnerable-free version of Node.js.