5

CVE-2013-4450: nodejs node.js Improper Input Validation

Modified
AliasesRHSA-2013:1842UBUNTU-CVE-2013-4450DEBIAN-CVE-2013-4450
Published 21-10-2013Last modified 06-08-2024

Vulnerability summary

CVE-2013-4450 is a medium (CVSS 5.0) Improper Input Validation vulnerability in nodejs node.js. EPSS estimates a 37.22% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (Metasploit, 18-10-2013)

Source freshness unavailable

How is this decided?
CVSS score
5.0/10
010
Medium · v2.0 (NVD)
EPSS score
37.22%
0%100%
High · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2github, metasploit

Advisory lineage

Upstream 0 · Downstream 1
MGASA-2014-0007

Timeline

  1. 21-10-2013
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

37.22%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 37.22% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • githubUnverified

    Metasploit Framework

    Maturity: poc

  • MetasploitMetasploitremoteUnverified

    Node.js HTTP Pipelining Denial of Service

    auxiliary/dos/http/nodejs_pipelining

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat4 products
  • nodejs010-nodejs< 0:0.10.5-8.el6
  • nodejs010-nodejs-debuginfo< 0:0.10.5-8.el6
  • nodejs010-nodejs-devel< 0:0.10.5-8.el6
  • nodejs010-nodejs-docs< 0:0.10.5-8.el6
Debian1 product
  • nodejs< 0.10.21~dfsg1-1
Nodejs1 product
  • node.js0.8.0 | 0.8.1 | 0.8.2 | 0.8.3 | 0.8.4 | 0.8.5 | 0.8.6 | 0.8.7 | 0.8.8 | 0.8.9 | 0.8.10 | 0.8.11 | 0.8.12 | 0.8.13 | 0.8.14 | 0.8.15 | 0.8.16 | 0.8.17 | 0.8.18 | 0.8.19 | 0.8.20 | 0.8.21 | 0.8.22 | 0.8.23 | 0.8.24 | 0.8.25 | 0.10.0 | 0.10.1 | 0.10.2 | 0.10.3 | 0.10.4 | 0.10.5 | 0.10.6 | 0.10.7 | 0.10.8 | 0.10.9 | 0.10.10 | 0.10.11 | 0.10.12 | 0.10.13 | 0.10.14 | 0.10.15 | 0.10.16 | 0.10.17 | 0.10.18 | 0.10.19 | 0.10.20
Ubuntu1 product
  • nodejs< 0.10.25~dfsg2-2ubuntu1

4 vendors · 7 products

References

20 links
Show all 20 references