Unscored severity · published Oct 21, 2013
CVE-2013-4450
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large…
–
CVSS
37.2%
EPSS
No
On KEV
Description
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
Exploitation
Is it being used?
Exploit prediction (EPSS)37.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Nodejs · Nodejs
0.8.0; 0.8.1; 0.8.2; 0.8.3; 0.8.4; 0.8.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4450
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4450
Patch
http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/
Patch
http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-12/msg00051.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1842.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/10/20/1
www.securityfocus.com
http://www.securityfocus.com/bid/63229
More from Nodejs
8.1
CVE-2024-36138
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn /…
7.7
CVE-2023-30584
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model
7.5
CVE-2023-30587
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector)
7.5
CVE-2023-30583
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20
7.4
CVE-2023-46809
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack -…