CVE-2017-14919

Description

Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.

CVSS breakdown

Affected products

• nodejs / node.js4.8.2 – 4.8.2
• nodejs / node.js4.8.3 – 4.8.3
• nodejs / node.js4.8.4 – 4.8.4
• nodejs / node.js6.10.2 – 6.10.2
• nodejs / node.js6.10.3 – 6.10.3
• nodejs / node.js6.11.0 – 6.11.0
• nodejs / node.js6.11.1 – 6.11.1
• nodejs / node.js6.11.2 – 6.11.2
• nodejs / node.js6.11.3 – 6.11.3
• nodejs / node.js6.11.4 – 6.11.4
• nodejs / node.js8.0.0 – 8.0.0
• nodejs / node.js8.1.0 – 8.1.0
• nodejs / node.js8.1.1 – 8.1.1
• nodejs / node.js8.1.2 – 8.1.2
• nodejs / node.js8.1.3 – 8.1.3
• nodejs / node.js8.1.4 – 8.1.4
• nodejs / node.js8.2.0 – 8.2.0
• nodejs / node.js8.2.1 – 8.2.1
• nodejs / node.js8.3.0 – 8.3.0
• nodejs / node.js8.4.0 – 8.4.0
• nodejs / node.js8.5.0 – 8.5.0
• nodejs / node.js8.6.0 – 8.6.0
• nodejs / node.js8.7.0 – 8.7.0

References

• MISChttp://www.securityfocus.com/bid/101881
• MISChttps://nodejs.org/en/blog/vulnerability/oct-2017-dos/
• MISChttps://nodejs.org/en/blog/release/v8.8.0/
• MISChttps://nodejs.org/en/blog/release/v6.11.5/
• MISChttps://nodejs.org/en/blog/release/v4.8.5/