CVE-2018-12121: nodejs node.js Uncontrolled Resource Consumption
Vulnerability summary
CVE-2018-12121 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in nodejs node.js. EPSS estimates a 10.21% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 10% (FIRST, 04-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 5Timeline
- 28-11-2018PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
CVSS metrics
6 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
10.21%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 10.21% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat10 products
- enterprise_linux8.0
- enterprise_linux_desktop7.0
- enterprise_linux_eus8.1 | 8.2 | 8.4 | 8.6
- enterprise_linux_server7.0
- enterprise_linux_server_aus8.2 | 8.4 | 8.6
Alpine2 products
- nodejs< 10.14.0-r0 | < 8.14.0-r0
- nodejs-current< 11.3.0-r0
Debian1 product
- nodejs< 10.15.0~dfsg-6
Nodejs1 product
- node.js≥ 6.0.0, < 6.15.0 | ≥ 8.0.0, < 8.14.0 | ≥ 10.0.0, < 10.14.0 | ≥ 11.0.0, < 11.3.0
The node.js project1 product
- node.jsAll versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0
Ubuntu1 product
- nodejsAll versions (No fix recorded)
6 vendors · 16 products
References
19 links- nodejs.org/en/blog/vulnerability/november-2018-security-releases/X Refsource CONFIRMPatchVendor AdvisoryREPORT
- access.redhat.com/errata/RHSA-2019:3497Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
