CVE-2019-5737: nodejs node.js Uncontrolled Resource Consumption
Vulnerability summary
CVE-2019-5737 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in nodejs node.js. EPSS estimates a 16.18% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 16% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 4Timeline
- 28-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
16.18%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
No change 0.00 pp
From 16.18% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse3 products
- nodejs10&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 10.15.2-1.6.1
- nodejs10&distro=SUSE Linux Enterprise Module for Web and Scripting 15< 10.15.2-1.6.1
- nodejs8&distro=SUSE Linux Enterprise Module for Web and Scripting 15< 8.15.1-3.14.1
Alpine2 products
- nodejs< 10.15.3-r0
- nodejs-current< 11.10.1-r0
Debian1 product
- nodejs< 10.15.2~dfsg-1
Nodejs1 product
- node.jsAll versions prior to 6.17.0 | All versions prior to 8.15.1 | All versions prior to 10.15.2 | All versions prior to 11.10.1 | ≥ 6.0.0, < 6.17.0 | ≥ 8.0.0, < 8.15.1 | ≥ 10.0.0, < 10.15.2 | ≥ 11.0.0, < 11.10.1
Opensuse1 product
- leapEOL42.3
Ubuntu1 product
- nodejsAll versions (No fix recorded) | < 8.10.0~dfsg-2ubuntu0.4+esm1
6 vendors · 9 products
References
18 links- nodejs.org/en/blog/vulnerability/february-2019-security-releases/X Refsource MISCREPORTThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00059.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
