CVE-2017-15896: nodejs node.js
Vulnerability summary
CVE-2017-15896 is a critical (CVSS 9.1) vulnerability in nodejs node.js. EPSS estimates a 2.38% chance of exploitation in the next 30 days, higher than 83.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 11-12-2017PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
2.38%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.38% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Alpine1 product
- nodejs< 8.9.3-r0
Nodejs1 product
- node.js≥ 4.0.0, ≤ 4.1.2 | ≥ 4.2.0, < 4.8.7 | ≥ 6.0.0, ≤ 6.8.1 | ≥ 6.9.0, < 6.12.2 | ≥ 8.0.0, ≤ 8.8.1 | ≥ 8.9.0, < 8.9.3 | ≥ 9.0.0, < 9.2.1
The node.js project1 product
- node.js4.0.0 and higher | 6.0.0 and higher | 8.0.0 and higher | 9.0.0 and higher
Ubuntu1 product
- nodejs< 8.10.0~dfsg-2
4 vendors · 4 products
References
4 links- nodejs.org/en/blog/vulnerability/december-2017-security-releases/X Refsource CONFIRMIssue TrackingVendor AdvisoryREPORT