CVE-2013-4450
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers...
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
Exploit likelihood
What each source reports
NVD Score used
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
- Record
CVE-2013-4450- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
- Record
CVE-2013-4450- Updated
- 2026-11-02
EUVDEUVD-2013-4321 No score
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
- Record
EUVD-2013-4321- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qf9f-226q-7q59 No score
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers...
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
- Record
GHSA-qf9f-226q-7q59- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVBELL-CVE-2013-4450
CVE-2013-4450 does not affect BellSoft software
- Record
BELL-CVE-2013-4450- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSV No score
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
- Record
CVE-2013-4450- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4450 No score
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
- Record
DEBIAN-CVE-2013-4450- Updated
- 2026-11-02
OSVMGASA-2014-0007 No score
Updated nodejs package fixes security vulnerabilities
A denial of service flaw was found in the way Node.js handled pipelined HTTP requests. A remote attacker could use this flaw to send an excessive amount of HTTP requests over a network connection, causing Node.js to use an excessive amount of memory and possibly exit when all available memory is exhausted (CVE-2013-4450).
Denial of service issues in the bundled v8 JavaScript library (CVE-2013-6639, CVE-2013-6640).
- Record
MGASA-2014-0007- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4450 No score
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.
- Record
UBUNTU-CVE-2013-4450- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nodejsDebian:12 |
before 0.10.21~dfsg1-1 | 0.10.21~dfsg1-1 |
nodejsDebian:13 |
before 0.10.21~dfsg1-1 | 0.10.21~dfsg1-1 |
nodejsDebian:14 |
before 0.10.21~dfsg1-1 | 0.10.21~dfsg1-1 |
nodejsMageia:3 From an advisory covering 3 CVEs |
before 0.10.24-1.mga3 | 0.10.24-1.mga3 |
nodejs010-nodejsRed Hat:rhel_software_collections:1::el6 |
before 0:0.10.5-8.el6 | 0:0.10.5-8.el6 |
nodejs010-nodejs-debuginfoRed Hat:rhel_software_collections:1::el6 |
before 0:0.10.5-8.el6 | 0:0.10.5-8.el6 |
nodejs010-nodejs-develRed Hat:rhel_software_collections:1::el6 |
before 0:0.10.5-8.el6 | 0:0.10.5-8.el6 |
nodejs010-nodejs-docsRed Hat:rhel_software_collections:1::el6 |
before 0:0.10.5-8.el6 | 0:0.10.5-8.el6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Node.js HTTP Pipelining Denial of Service | 2013-10-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4450 is a medium vulnerability (CVSS 5.0) in Nodejs, published October 21, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 37.2%, the 98th percentile. Fixed in nodejs 0.10.21~dfsg1-1.
References
kb.juniper.net/JSA10783
rhn.redhat.com/errata/RHSA-2013-1842.html
lists.opensuse.org/opensuse-updates/2013-12/msg00051.html
openwall.com/lists/oss-security/2013/10/20/1
securityfocus.com/bid/63229
blog.nodejs.org/2013/10/18/node-v0-10-21-stable
Show 20 moreShow less
github.com/rapid7/metasploit-framework/pull/2548
groups.google.com/forum
nvd.nist.gov/vuln/detail/CVE-2013-4450
docs.bell-sw.com/security/cves/CVE-2013-4450
security-tracker.debian.org/tracker/CVE-2013-4450
advisories.mageia.org/MGASA-2014-0007.html
bugs.mageia.org/show_bug.cgi?id=11981
access.redhat.com/errata/RHSA-2013:1842
bugzilla.redhat.com/show_bug.cgi?id=1021170
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1842.json
cve.org/CVERecord?id=CVE-2013-4450
ubuntu.com/security/CVE-2013-4450