CVE-2018-7164: Memory exhaustion DoS on v9.x
Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.
Other sources
Versions 9.7.0 and later are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behavior.
All versions of Node.js 6.x (LTS "Boron") are NOT vulnerable
All versions of Node.js 8.x (LTS "Carbon") are NOT vulnerable
Versions of Node.js 9.7.0 and higher are vulnerable
All versions of Node.js 10.x (Current) are vulnerable
— Node.Js
Versions 9.7.0 and later are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.11.2Fixed in 10.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.11.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2018-7164?
The severity of CVE-2018-7164 is classified as MEDIUM.
How does CVE-2018-7164 impact Node.js?
CVE-2018-7164 increases memory consumption when reading from the network into JavaScript, potentially leading to a denial of service.
Which versions of Node.js are affected by CVE-2018-7164?
CVE-2018-7164 affects Node.js versions 9.7.0 to 9.11.2 and 10.0.0 to 10.4.1.
How can I mitigate CVE-2018-7164?
To mitigate CVE-2018-7164, upgrade Node.js to versions beyond 9.11.2 or 10.4.1.
Is CVE-2018-7164 a remote code execution vulnerability?
No, CVE-2018-7164 is primarily a denial of service vulnerability, not a remote code execution vulnerability.