Vulnerability · Published Sep 18, 2020 · Assigned by hackerone

CVE-2020-8251

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.4% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)8.4%top 5.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	nodejs-current	14.11.0-r0	ALPINE-CVE-2020-8251
Alpine:v3.21	nodejs-current	14.11.0-r0	ALPINE-CVE-2020-8251
Alpine:v3.22	nodejs-current	14.11.0-r0	ALPINE-CVE-2020-8251
Alpine:v3.23	nodejs-current	14.11.0-r0	ALPINE-CVE-2020-8251
Alpine:v3.24	nodejs-current	14.11.0-r0	ALPINE-CVE-2020-8251

Affected products (as reported)

Vendor	Product	Versions
NodeJS	Node	4.0 – before 4.5.0 – before 5.6.0 – before 6.7.0 – before 7.8.0 – before 8.9.0 – before 9.11.0 – before 11.13.0 – before 13.

Weakness: CWE-400

References

https://hackerone.com/reports/868834 x_refsource_MISC
https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/ x_refsource_MISC
https://security.netapp.com/advisory/ntap-20201009-0004/ x_refsource_CONFIRM
FEDORA-2020-43d5a372fc vendor-advisory, x_refsource_FEDORA
GLSA-202101-07 vendor-advisory, x_refsource_GENTOO