CVE-2017-14919High· 7.5▾ TwilightNode.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBit…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 1.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
8.2%
8.2% → 8.3%
Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.
node.js = 4.8.2node.js = 4.8.3node.js = 4.8.4node.js = 6.10.2node.js = 6.10.3node.js = 6.11.0node.js = 6.11.1node.js = 6.11.2node.js = 6.11.3node.js = 6.11.4node.js = 8.0.0node.js = 8.1.0node.js = 8.1.1node.js = 8.1.2node.js = 8.1.3node.js = 8.1.4node.js = 8.2.0node.js = 8.2.1node.js = 8.3.0node.js = 8.4.0node.js = 8.5.0node.js = 8.6.0node.js = 8.7.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2018-12123Medium· 4.3Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed…
CVE-2018-7161High· 7.5All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH
CVE-2018-7162High· 7.5All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH
CVE-2018-7159Medium· 5.3The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`
CVE-2018-7160High· 8.8The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution
CVE-2026-21712Medium· 6.5A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.