CVE-2018-7161
- State
- Published
- Severity
- Not scored
- Published
- Jun 13, 2018
- Updated
- Oct 8, 2026
- Reserved
- Feb 15, 2018
Description
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Node.jsThe Node.js Project |
|
References
- 106363vdb-entry
- https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/
- GLSA-202003-48vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.