Input validation error in Node.js - CVE-2015-8027
Published: January 2, 2016 / Updated: August 4, 2020
Vulnerability identifier: #VU33814
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-8027
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.
Affected software
Node.js
nodejs (Alpine package)
nodejs (Alpine package)
How to mitigate CVE-2015-8027
Install update from vendor's website.
Node.js - update to 0.12.9
nodejs (Alpine package) - update to 0.12.9-r0
nodejs (Alpine package) - update to 0.12.9-r0
External References
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00045.html
- http://www.securityfocus.com/bid/78207
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV79524
- http://www-01.ibm.com/support/docview.wss?uid=swg21972419
- https://nodejs.org/en/blog/vulnerability/cve-2015-8027_cve-2015-6764/
- https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/
- https://security.gentoo.org/glsa/201612-43