CVE-2018-7164 — Vulnetix

Try Vulnetix Request Demo

CVE-2018-7164 PUBLISHED CVSS 7.5 HIGH

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.

EPSS 1.07% · 77.6th percentile

Risk Scores

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

1.07%

77.6th percentile

Affected Products

Vendor	Product	Versions
nodejs	node.js	9.7.0, 10.0.0
The Node.js Project	Node.js	9.7.X+, 10.x+

Timeline

Jun 13, 2018 CVE Published
Apr 14, 2021 EPSS Score
Jun 22, 2021 EPSS Score
Aug 23, 2021 EPSS Score
Oct 24, 2021 EPSS Score
Dec 25, 2021 EPSS Score
Apr 28, 2022 EPSS Score
Jun 29, 2022 EPSS Score
Aug 31, 2022 EPSS Score
Nov 1, 2022 EPSS Score
Jan 2, 2023 EPSS Score
Mar 5, 2023 EPSS Score

References

104463 vdb
https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/ url
GLSA-202003-48 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-7164 advisory
https://nodejs.org/en/blog/vulnerability/june-2018-security-releases url

Open in Interactive Console →