MediumNode.js

CVE-2017-14919

Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.

CVSS Base Score

5.0

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploit Probability

More exploitable than 94% of all CVEs · Top 6%

Is your site exposed to this?

Run a free scan. UNPWNED fingerprints your stack and flags this CVE class if the affected technology is detected.

Check my site

Details

Published: 2017-10-30
Last modified: 2026-07-14
Affected: Node.js

References

NVD Detail OSV.dev GitHub Advisories

Related exploited CVEs in Node.js

CVE-2016-9841

Critical · 9.8 CVSSNode.js

CVE-2016-9842

High · 8.8 CVSSNode.js

CVE-2016-9840

High · 8.8 CVSSNode.js

Data from the National Vulnerability Database (NVD), CISA KEV, and FIRST.org EPSS. This product uses the NVD API but is not endorsed or certified by the NVD. EPSS is a probability estimate, not a guarantee of exploitation.