CVE-2019-5737
CVE-2019-5737 is a high-severity vulnerability in Nodejs Node.js with a CVSS 3.x base score of 7.5. Its EPSS exploit-prediction score of 16% places it in the 97th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-770.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v2: 5.0
- EPSS exploit prediction: 16% (97th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-770
- Affected product: Nodejs Node.js
- Published:
- Last modified:
Description
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
Frequently asked questions
- What is CVE-2019-5737?
- In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
- How severe is CVE-2019-5737?
- CVE-2019-5737 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2019-5737 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 16% (97th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2019-5737?
- CVE-2019-5737 primarily affects Nodejs Node.js. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2019-5737?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2019-5737 published?
- CVE-2019-5737 was published on 2019-03-28 and last updated on 2026-06-17.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.html
- https://access.redhat.com/errata/RHSA-2019:1821
- https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/
- https://security.gentoo.org/glsa/202003-48
- https://security.netapp.com/advisory/ntap-20190502-0008/
Affected products (3)
- cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
- cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
- cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
More vulnerabilities in Nodejs Node.js
- CVE-2026-21636 — Critical (CVSS 10.0): A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when…
- CVE-2015-0278 — Critical (CVSS 10.0): libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain…
- CVE-2026-48930 — Critical (CVSS 9.8): A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to…
- CVE-2024-3566 — Critical (CVSS 9.8): A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly…
- CVE-2024-21896 — Critical (CVSS 9.8): The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the…
- CVE-2023-39332 — Critical (CVSS 9.8): Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments,…
All CVEs affecting Nodejs Node.js →
Other CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities
- CVE-2026-31283 — Critical (CVSS 9.8): In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email…
- CVE-2020-37067 — Critical (CVSS 9.8): Filetto 1.0 FTP server contains a denial of service vulnerability in the FEAT command processing that allows attackers…
- CVE-2021-47875 — Critical (CVSS 9.8): GeoGebra CAS Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the…
- CVE-2025-11832 — Critical (CVSS 9.8): Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access…
- CVE-2024-44241 — Critical (CVSS 9.8): The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia…
- CVE-2022-3439 — Critical (CVSS 9.8): Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
Browse all CWE-770 (Allocation of Resources Without Limits or Throttling) vulnerabilities →