CVE-2019-5737: High severity langgenius dify node.js vulnerability
All actively supported release lines are vulnerable and the severity is LOW. An attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly thereby keeping the connection and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer.
Reference: https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/
Other sources
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-5737?
CVE-2019-5737 has a Moderate severity rating due to its potential to cause Denial of Service (DoS).
How do I fix CVE-2019-5737?
To fix CVE-2019-5737, upgrade Node.js to version 6.17.0, 8.15.1, 10.15.2, or 11.10.1 or later.
Which versions of Node.js are affected by CVE-2019-5737?
CVE-2019-5737 affects Node.js versions before 6.17.0, 8.15.1, 10.15.2, and 11.10.1.
What type of vulnerability is CVE-2019-5737?
CVE-2019-5737 is a Denial of Service (DoS) vulnerability that can be triggered by slow HTTP header transmission.
Can CVE-2019-5737 be exploited remotely?
Yes, CVE-2019-5737 can be exploited remotely by sending headers slowly over a keep-alive connection.