Input validation error in Node.js - CVE-2017-14919
Published: October 30, 2017 / Updated: July 28, 2020
Vulnerability identifier: #VU32063
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-14919
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.
Affected software
Node.js
nodejs (Alpine package)
nodejs
Fedora
nodejs (Alpine package)
nodejs
Fedora
How to mitigate CVE-2017-14919
Install update from vendor's website.
Node.js - addressed in versions 4.8.5, 6.11.5, 8.8.0
nodejs (Alpine package) - update to 6.11.5-r0
nodejs - addressed in versions 6.11.5-1.el7, 6.11.5-1.fc25, 6.11.5-1.fc26
nodejs (Alpine package) - update to 6.11.5-r0
nodejs - addressed in versions 6.11.5-1.el7, 6.11.5-1.fc25, 6.11.5-1.fc26