---
id: CVE-2018-7161
title: >-
  All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is
  HIGH
summary: >-
  All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is
  HIGH. An attacker can cause a denial of service (DoS) by causing a node server
  providing an http2 server to crash. This can be accomplished by interacting
  with…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-20
  - CWE-400
vendor: nodejs
product: node.js
affected:
  - 'node.js >= 8.0.0, <= 8.8.1'
  - 'node.js >= 8.9.0, < 8.11.3'
  - 'node.js >= 9.0.0, < 9.11.2'
  - 'node.js >= 10.0.0, < 10.4.1'
patched:
  - node.js 10.4.1
published: '2018-06-13'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T22:16:47.803'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-7161'
references:
  - url: 'http://www.securityfocus.com/bid/106363'
    label: cve-request@iojs.org
  - url: 'https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/'
    label: cve-request@iojs.org
  - url: 'https://security.gentoo.org/glsa/202003-48'
    label: cve-request@iojs.org
  - url: 'http://www.securityfocus.com/bid/106363'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202003-48'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-7161.json
  - url: 'https://access.redhat.com/security/cve/CVE-2018-7161'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1591013'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2018-7161'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2018-7161'
  - url: 'https://access.redhat.com/errata/RHSA-2018:2949'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.07485
epssPercentile: 0.94447
ingestedAt: '2026-10-08T23:16:47.290Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-08T21:11:49.304319Z'
---

## Overview

All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.

## Affected

- `node.js >= 8.0.0, <= 8.8.1`
- `node.js >= 8.9.0, < 8.11.3`
- `node.js >= 9.0.0, < 9.11.2`
- `node.js >= 10.0.0, < 10.4.1`

## Remediation

Upgrade past the affected range:

- `node.js 10.4.1`

## Vendor advisories

- **RHSA-2018:2949** · Red Hat · fixed in: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4), Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5), Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) · released 2018-10-18 · [advisory](https://access.redhat.com/errata/RHSA-2018:2949)