CVE-2019-5739CWE-400

CVE-2019-5739: vulnerability in Node.js

Published · Updated

Follow this CVE+ Monitor Node.js+ Monitor nodejs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 4.9%
Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.
Affected products
Node.js · Node.js
Related CVEs — Node.js

In the same product, most dangerous first.

CVE-2019-5737—CVE-2019-5737EPSS 16.2%CVE-2024-3566CRITICALCommand injection vulnerability in programing languages on Microsoft Windows operating system.EPSS 6.8%