CVE-2018-7164

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2018
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-71667.5In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This m CVE-2018-71677.5Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to addre CVE-2018-71695.3An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespac CVE-2018-71705.3ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitraril CVE-2018-71717.5Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories CVE-2018-71724.9In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal.CVE-2018-71735.5A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 allows an attacker to cause denial of service via a specific file due to inappro CVE-2018-71745.5An issue was discovered in xpdf 4.00. An infinite loop in XRef::Xref allows an attacker to cause denial of service because loop detection ex CVE-2018-71755.5An issue was discovered in xpdf 4.00. A NULL pointer dereference in readCodestream allows an attacker to cause denial of service via a JPX i CVE-2018-71768.8FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the CVE-2018-71779.8SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.CVE-2018-71789.8SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter.