CVE-2018-7161

Publication date 13 June 2018

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
nodejs	18.10 cosmic	Not affected
	18.04 LTS bionic	Fixed 8.10.0~dfsg-2ubuntu0.2
	17.10 artful	Ignored end of life
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
nodejs	Upstream: 354f2d9

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H