CVE-2018-7164: High severity Nodejs Node.js vulnerability
Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7164?
The severity of CVE-2018-7164 is classified as MEDIUM.
How does CVE-2018-7164 impact Node.js?
CVE-2018-7164 increases memory consumption when reading from the network into JavaScript, potentially leading to a denial of service.
Which versions of Node.js are affected by CVE-2018-7164?
CVE-2018-7164 affects Node.js versions 9.7.0 to 9.11.2 and 10.0.0 to 10.4.1.
How can I mitigate CVE-2018-7164?
To mitigate CVE-2018-7164, upgrade Node.js to versions beyond 9.11.2 or 10.4.1.
Is CVE-2018-7164 a remote code execution vulnerability?
No, CVE-2018-7164 is primarily a denial of service vulnerability, not a remote code execution vulnerability.