CVE-2020-8251
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests...
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
- Record
CVE-2020-8251- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
- Record
CVE-2020-8251- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2020-29121 No score
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
- Record
EUVD-2020-29121- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9cwr-72m4-73jq
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests...
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
- Record
GHSA-9cwr-72m4-73jq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-8251
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
- Record
ALPINE-CVE-2020-8251- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2020-8251
CVE-2020-8251 does not affect BellSoft software
- Record
BELL-CVE-2020-8251- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSV
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
- Record
CVE-2020-8251- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-node-2020-8251 No score
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
- Record
BIT-node-2020-8251- Updated
- 2026-11-02
OSVBIT-node-min-2020-8251 No score
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
- Record
BIT-node-min-2020-8251- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11096-1 No score
nodejs14-14.17.5-1.2 on GA media
These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11096-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nodejs-currentAlpine:v3.13 |
before 14.11.0-r0 | 14.11.0-r0 |
nodejs-currentAlpine:v3.14 |
before 14.11.0-r0 | 14.11.0-r0 |
nodejs-currentAlpine:v3.15 |
before 14.11.0-r0 | 14.11.0-r0 |
nodejs-currentAlpine:v3.16 |
before 14.11.0-r0 | 14.11.0-r0 |
nodejs-currentAlpine:v3.17 |
before 14.11.0-r0 | 14.11.0-r0 |
nodejs-currentAlpine:v3.18 |
before 14.11.0-r0 | 14.11.0-r0 |
nodejs-currentAlpine:v3.19 |
before 14.11.0-r0 | 14.11.0-r0 |
nodejs-currentAlpine:v3.20 |
before 14.11.0-r0 | 14.11.0-r0 |
nodejs-currentAlpine:v3.21 |
before 14.11.0-r0 | 14.11.0-r0 |
nodejs-currentAlpine:v3.22 |
before 14.11.0-r0 | 14.11.0-r0 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nodejs-currentAlpine:v3.23 |
before 14.11.0-r0 | 14.11.0-r0 |
nodejs-currentAlpine:v3.24 |
before 14.11.0-r0 | 14.11.0-r0 |
nodeBitnami |
14.0.0 up to 14.11.0 | 14.11.0 |
node-minBitnami |
14.0.0 up to 14.11.0 | 14.11.0 |
nodejs14openSUSE:Tumbleweed From an advisory covering 19 CVEs |
before 14.17.5-1.2 | 14.17.5-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8251 is a high vulnerability (CVSS 7.5) in Nodejs Node, published September 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.36%, the 94th percentile. Fixed in nodejs-current 14.11.0-r0.
References
hackerone.com/reports/868834
nodejs.org/en/blog/vulnerability/september-2020-security-releases
security.netapp.com/advisory/ntap-20201009-0004
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6
security.gentoo.org/glsa/202101-07
nvd.nist.gov/vuln/detail/CVE-2020-8251
Show 23 moreShow less
github.com/advisories/GHSA-9cwr-72m4-73jq
security.alpinelinux.org/vuln/CVE-2020-8251
docs.bell-sw.com/security/cves/CVE-2020-8251
suse.com/security/cve/CVE-2020-11080