What’s Vulnerable › Vulnerabilities

CVE-2018-12122

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 41.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-11-28 · updated 2026-10-08
• Weakness: CWE-400

Description

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.

Affected products

• Node.js: from 6.0.0 before 6.15.1; from 8.0.0 before 8.14.0; from 10.0.0 before 10.14.0; from 11.0.0 before 11.3.0 — fixed in 10.14.0, 11.3.0, 6.15.1, 8.14.0
• Suse Enterprise Storage: 4
• SUSE Linux Enterprise: 12, 15
• Suse Openstack Cloud: 7, 8

How to fix

Upgrade to a fixed version: Node.js 10.14.0, 11.3.0, 6.15.1, 8.14.0. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/106043
• https://access.redhat.com/errata/RHSA-2019:1821
• https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
• https://security.gentoo.org/glsa/202003-48
• http://www.securityfocus.com/bid/106043
• https://access.redhat.com/errata/RHSA-2019:1821
• https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
• https://security.gentoo.org/glsa/202003-48
• https://security.netapp.com/advisory/ntap-20241213-0009/

Get alerted when CVE-2018-12122 or the next vulnerability affects your stack