Heap-based buffer overflow in Node.js - CVE-2018-12121

Vulnerability identifier: #VU16168

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-12121

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow. A remote attacker can send many requests with the maximum size HTTP header of nearly 80kb/connection in combination with carefully handled completion of those headers, trigger memory corruption and cause the Node.js HTTP server to abort.

Node.js
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Opensuse
IBM Cloud Transformation Advisor
nodejs-current (Alpine package)
rh-nodejs8-nodejs (Red Hat package)

The vulnerability has been fixed in the versions 6.15.0, 8.14.0, 10.14.0, 11.3.0.

Node.js - addressed in versions 6.15.0, 8.14.0, 10.14.0, 11.3.0
IBM Cloud Transformation Advisor - update to 1.9.2
nodejs-current (Alpine package) - update to 11.3.0-r0
rh-nodejs8-nodejs (Red Hat package) - update to 8.16.0-1.el7

• https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

• Multiple vulnerabilities in Node.js
• OpenSUSE Linux update for nodejs4
• OpenSUSE Linux update for nodejs8
• OpenSUSE Linux update for nodejs6
• Red Hat update for http-parser
• Red Hat update for http-parser
• Gentoo update for Node.js
• Amazon Linux AMI update for http-parser
• Heap-based buffer overflow in nodejs-current (Alpine package)
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Red Hat Software Collections update for rh-nodejs8-nodejs