{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2018-12122","sourceIdentifier":"cve-request@iojs.org","published":"2018-11-28T17:29:00.370","lastModified":"2026-10-08T22:16:45.057","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time."},{"lang":"es","value":"Node.js: Todas las versiones anteriores a la 6.15.0, 8.14.0, 10.14.0 y 11.3.0: Denegación de servicio (DoS) HTTP mediante Slowloris. Un atacante puede provocar una denegación de servicio (DoS) enviando cabeceras muy lentamente, manteniendo las conexiones HTTP o HTTPS y los recursos asociados vivos durante un largo período de tiempo."}],"affected":[{"source":"cve-request@iojs.org","affectedData":[{"vendor":"The Node.js Project","product":"Node.js","versions":[{"version":"All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T21:10:50.953890Z","id":"CVE-2018-12122","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-request@iojs.org","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.15.1","matchCriteriaId":"E50DE84C-B33E-46D2-A53C-DE13EB7ACE3F"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.14.0","matchCriteriaId":"1B607427-7A5B-4F24-B042-CF4BF95DC185"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.14.0","matchCriteriaId":"34D3C40A-3BE7-42A4-BE15-762CEE1754C4"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"11.0.0","versionEndExcluding":"11.3.0","matchCriteriaId":"4E62EA78-C705-4AC9-9C0B-3C9114087C37"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:suse:suse_enterprise_storage:4:*:*:*:*:*:*:*","matchCriteriaId":"30A38AC5-A8B9-4244-8093-40C77ADFF5F2"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*","matchCriteriaId":"9C649194-B8C2-49F7-A819-C635EE584ABF"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:suse_linux_enterprise_server:15:*:*:*:*:*:*:*","matchCriteriaId":"AF73A3D9-6566-4CBF-AA5F-5A4B99719A1D"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:suse_openstack_cloud:7:*:*:*:*:*:*:*","matchCriteriaId":"F4B73BE9-4340-4A6B-89FE-A40FC4A10187"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*","matchCriteriaId":"C9C659D0-D6DB-4313-9208-C0C49FECD290"}]}]}],"references":[{"url":"http://www.securityfocus.com/bid/106043","source":"cve-request@iojs.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1821","source":"cve-request@iojs.org","tags":["Third Party Advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","source":"cve-request@iojs.org","tags":["Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202003-48","source":"cve-request@iojs.org","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/106043","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1821","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202003-48","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241213-0009/","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}