CVE-2020-8251: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests
Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests
Other sources
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
Node.js is vulnerable to a denial of service, caused by delayed unfinished HTTP/1.1 requests submission. An attacker could exploit this vulnerability to make the server unable to accept new connections and exhaust all available resources.
— IBM
Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout with a default value of 0 which means it is disabled by default. This should be set when Node.js is used as an edge server, for more details refer to the documentation.
All versions of the 14.x release line
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.11.0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 14.11.0-r0 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 14.11.0 - Configuration
Set requestTimeout when Node.js is used as an edge server; its default value of 0 disables the timeout.
Node.js http.Server requestTimeout = non-zero timeout value
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8251?
CVE-2020-8251 is a vulnerability in Node.js that allows for HTTP denial of service (DoS) attacks based on delayed requests submission.
What is the severity of CVE-2020-8251?
The severity of CVE-2020-8251 is high (7.5).
How does CVE-2020-8251 affect Node.js?
CVE-2020-8251 affects Node.js versions prior to 14.11.0, making them vulnerable to denial of service attacks.
How can an attacker exploit CVE-2020-8251?
An attacker can exploit CVE-2020-8251 by sending delayed unfinished HTTP/1.1 requests, causing the server to be unable to accept new connections and exhaust all available resources.
How can I fix CVE-2020-8251?
To fix CVE-2020-8251, it is recommended to update Node.js to version 14.11.0 or higher, as this vulnerability has been patched in that version.