{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2018-7164","sourceIdentifier":"cve-request@iojs.org","published":"2018-06-13T16:29:01.827","lastModified":"2026-10-08T22:16:48.087","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour."},{"lang":"es","value":"Todas las versiones 9.7.0 y posteriores y 10.x de Node.js son vulnerables y la gravedad es MEDIA. Un error introducido en la versión 9.7.0 aumenta la memoria consumida cuando se lee desde la red en JavaScript mediante el uso del objeto net.Socket directamente como transmisión. Un atacante podría emplear esto para provocar una denegación de servicio (DoS) mediante el envío de fragmentos diminutos de datos en una sucesión corta. Esta vulnerabilidad se solucionó volviendo al comportamiento anterior."}],"affected":[{"source":"cve-request@iojs.org","affectedData":[{"vendor":"The Node.js Project","product":"Node.js","versions":[{"version":"9.7.X+","status":"affected"},{"version":"10.x+","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-08T21:12:09.397604Z","id":"CVE-2018-7164","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","versionStartIncluding":"9.7.0","versionEndExcluding":"9.11.2","matchCriteriaId":"7CE5845F-4758-41B7-B801-6785E22BDF94"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.4.1","matchCriteriaId":"5FF733A8-C8E5-4F47-8494-20D4AC10B1D0"}]}]}],"references":[{"url":"http://www.securityfocus.com/bid/104463","source":"cve-request@iojs.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/","source":"cve-request@iojs.org","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202003-48","source":"cve-request@iojs.org","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/104463","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202003-48","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}