CVE-2019-5737 — nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass

Back Back to CVE browser

HIGH

nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass

Published Mar 28, 2019

7.5

HIGH

CVSS 3.1

EPSS 16.18%

Description

In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.

Affected products

Vendor Node.js Product Node.js Default
n/a
- Version
  All versions prior to 10.15.2
  Status
  affected
  Constraints
  -
- Version
  All versions prior to 11.10.1
  Status
  affected
  Constraints
  -
- Version
  All versions prior to 6.17.0
  Status
  affected
  Constraints
  -
- Version
  All versions prior to 8.15.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Node.js

n/a

Version	Status	Constraints
All versions prior to 10.15.2	affected	-
All versions prior to 11.10.1	affected	-
All versions prior to 6.17.0	affected	-
All versions prior to 8.15.1	affected	-

Red Hat Enterprise Linux 8

nodejs:10-8000020190911085529.f8e95b4e

Fixed · RHSA-2019:2925
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-nodejs10-0:3.2-3.el7

Fixed · RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-nodejs10-nodejs-0:10.16.3-3.el7

Fixed · RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-nodejs8-nodejs-0:8.16.0-1.el7

Fixed · RHSA-2019:1821
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS

rh-nodejs8-nodejs-0:8.16.0-1.el7

Fixed · RHSA-2019:1821
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

rh-nodejs10-0:3.2-3.el7

Fixed · RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

rh-nodejs10-nodejs-0:10.16.3-3.el7

Fixed · RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

rh-nodejs8-nodejs-0:8.16.0-1.el7

Fixed · RHSA-2019:1821
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-nodejs10-0:3.2-3.el7

Fixed · RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-nodejs10-nodejs-0:10.16.3-3.el7

Fixed · RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-nodejs8-nodejs-0:8.16.0-1.el7

Fixed · RHSA-2019:1821
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-nodejs10-0:3.2-3.el7

Fixed · RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-nodejs10-nodejs-0:10.16.3-3.el7

Fixed · RHSA-2019:2939
Red Hat OpenShift Application Runtimes

nodejs10

Not affected
Red Hat OpenShift Application Runtimes

nodejs8

Not affected
Red Hat OpenShift Container Platform 3.10

nodejs

Fix deferred
Red Hat OpenShift Container Platform 3.6

nodejs

Fix deferred
Red Hat OpenShift Container Platform 3.7

nodejs

Out of support scope
Red Hat OpenShift Container Platform 3.9

nodejs

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	nodejs:10-8000020190911085529.f8e95b4e	Fixed	RHSA-2019:2925
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-nodejs10-0:3.2-3.el7	Fixed	RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-nodejs10-nodejs-0:10.16.3-3.el7	Fixed	RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-nodejs8-nodejs-0:8.16.0-1.el7	Fixed	RHSA-2019:1821
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS	rh-nodejs8-nodejs-0:8.16.0-1.el7	Fixed	RHSA-2019:1821
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS	rh-nodejs10-0:3.2-3.el7	Fixed	RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS	rh-nodejs10-nodejs-0:10.16.3-3.el7	Fixed	RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS	rh-nodejs8-nodejs-0:8.16.0-1.el7	Fixed	RHSA-2019:1821
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-nodejs10-0:3.2-3.el7	Fixed	RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-nodejs10-nodejs-0:10.16.3-3.el7	Fixed	RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-nodejs8-nodejs-0:8.16.0-1.el7	Fixed	RHSA-2019:1821
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-nodejs10-0:3.2-3.el7	Fixed	RHSA-2019:2939
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-nodejs10-nodejs-0:10.16.3-3.el7	Fixed	RHSA-2019:2939
Red Hat OpenShift Application Runtimes	nodejs10	Not affected	n/a
Red Hat OpenShift Application Runtimes	nodejs8	Not affected	n/a
Red Hat OpenShift Container Platform 3.10	nodejs	Fix deferred	n/a
Red Hat OpenShift Container Platform 3.6	nodejs	Fix deferred	n/a
Red Hat OpenShift Container Platform 3.7	nodejs	Out of support scope	n/a
Red Hat OpenShift Container Platform 3.9	nodejs	Fix deferred	n/a

Remediation

Red Hat mitigation

The use of a Load Balancer or a Reverse Proxy will increase the difficulty of the attack.

Metrics

16.18% 0.16184

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.16184

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (28 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	16.18% (0.16184)	96.84th	v5 (v2026.06.15)
Jun 15, 2026	16.18% (0.16184)	96.52th	v5 (v2026.06.15)
Mar 8, 2026	26.35% (0.26351)	96.21th	v4 (v2025.03.14)
Nov 21, 2025	36.86% (0.36856)	96.96th	v4 (v2025.03.14)
Nov 18, 2025	40.40% (0.40396)	97.18th	v4 (v2025.03.14)
Aug 30, 2025	36.86% (0.36856)	97.02th	v4 (v2025.03.14)
Jun 26, 2025	29.34% (0.29342)	96.34th	v4 (v2025.03.14)
Jun 19, 2025	36.86% (0.36856)	96.94th	v4 (v2025.03.14)
May 30, 2025	30.29% (0.30291)	96.42th	v4 (v2025.03.14)
Mar 30, 2025	38.83% (0.38829)	96.97th	v4 (v2025.03.14)
Mar 29, 2025	60.51% (0.60509)	97.54th	v4 (v2025.03.14)
Mar 28, 2025	38.83% (0.38829)	96.97th	v4 (v2025.03.14)
Mar 27, 2025	49.94% (0.49944)	97.44th	v4 (v2025.03.14)
Mar 24, 2025	38.83% (0.38829)	96.94th	v4 (v2025.03.14)
Mar 23, 2025	49.94% (0.49944)	97.48th	v4 (v2025.03.14)
Mar 20, 2025	38.83% (0.38829)	96.99th	v4 (v2025.03.14)
Mar 19, 2025	49.94% (0.49944)	97.49th	v4 (v2025.03.14)
Mar 17, 2025	38.83% (0.38829)	96.92th	v4 (v2025.03.14)
Dec 12, 2024	1.35% (0.01348)	86.72th	v3 (v2023.03.01)
Mar 21, 2024	1.46% (0.01462)	86.42th	v3 (v2023.03.01)
Mar 7, 2023	1.09% (0.01090)	82.11th	v3 (v2023.03.01)
Mar 6, 2023	14.86% (0.14862)	95.89th	v2 (v2022.01.01)
Apr 1, 2022	14.86% (0.14862)	95.52th	v2 (v2022.01.01)
Feb 4, 2022	14.86% (0.14862)	91.25th	v2 (v2022.01.01)
Feb 3, 2022	8.63% (0.08626)	85.56th	v1
Jan 6, 2022	8.63% (0.08626)	85.39th	v1
Sep 1, 2021	8.63% (0.08626)	92.92th	v1
Apr 14, 2021	8.63% (0.08626)	0.00th	v1

Weaknesses (2)

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits

References (12)

http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html
vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html
vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html
vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:1821
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-5737
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1690808
Issue Tracking
https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/
x_refsource_MISCThird Party Advisory
https://nodejs.org/ja/blog/vulnerability/february-2019-security-releases/
https://nvd.nist.gov/vuln/detail/CVE-2019-5737
https://security.gentoo.org/glsa/202003-48
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://security.netapp.com/advisory/ntap-20190502-0008/
x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-5737

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html		vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html		vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html		vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:1821		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-5737		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1690808		Issue Tracking
https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/		x_refsource_MISCThird Party Advisory
https://nodejs.org/ja/blog/vulnerability/february-2019-security-releases/
https://nvd.nist.gov/vuln/detail/CVE-2019-5737
https://security.gentoo.org/glsa/202003-48		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://security.netapp.com/advisory/ntap-20190502-0008/		x_refsource_CONFIRMThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-5737