{"id":"CVE-2013-4450","aliases":["BELL-CVE-2013-4450","DEBIAN-CVE-2013-4450","EUVD-2013-4321","GHSA-qf9f-226q-7q59","MGASA-2014-0007","RHSA-2013:1842","UBUNTU-CVE-2013-4450"],"status":"published","title":"The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers...","description":"The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.3722,"percentile":0.98531,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-10-21T17:00:00Z","modified":"2026-09-01T20:03:18Z","exploits":[{"source":"metasploit","id":"auxiliary/dos/http/nodejs_pipelining","title":"Node.js HTTP Pipelining Denial of Service","type":"auxiliary","date":"2013-10-18","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/dos/http/nodejs_pipelining"}],"fixes":[{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["0.10.21~dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["0.10.21~dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["0.10.21~dfsg1-1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"nodejs010-nodejs","fixed_in":["0:0.10.5-8.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"nodejs010-nodejs-debuginfo","fixed_in":["0:0.10.5-8.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"nodejs010-nodejs-devel","fixed_in":["0:0.10.5-8.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"nodejs010-nodejs-docs","fixed_in":["0:0.10.5-8.el6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.21~dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.21~dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.21~dfsg1-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.24-1.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"nodejs010-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.5-8.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"nodejs010-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.5-8.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"nodejs010-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.5-8.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:1::el6","package":"nodejs010-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.5-8.el6"}]}]}],"products":[{"vendor":"nodejs","product":"nodejs"}],"references":[{"url":"https://kb.juniper.net/JSA10783","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1842.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-12/msg00051.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/10/20/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/63229","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","report"]},{"url":"http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/2548","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"https://groups.google.com/forum/#%21topic/nodejs/NEbweYB0ei0","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/joyent/node/issues/6214","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4450","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/nodejs/NEbweYB0ei0"},{"url":"http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable"},{"url":"http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance"},{"url":"https://github.com/advisories/GHSA-qf9f-226q-7q59"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2013-4450","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4450","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0007.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11981","tags":["report"]},{"url":"http://blog.nodejs.org/2013/10/22/cve-2013-4450-http-server-pipeline-flood-dos/","tags":["web"]},{"url":"http://blog.nodejs.org/2013/12/19/node-v0-10-24-stable/","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2013-1842.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1842","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1021170","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1842.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4450","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2013-4450","tags":["report"]},{"url":"https://github.com/joyent/node/commit/085dd30e93da67362f044ad1b3b6b2d997064692","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-4450","description":"The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.","status":"published","published":"2013-10-21T17:00:00Z","modified":"2024-08-06T16:45:14.825Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2013-4321","description":"The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.","status":"published","published":"2013-10-21T17:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.667445Z"}],"ghsa":[{"id":"GHSA-qf9f-226q-7q59","title":"The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers...","description":"The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.","status":"published","published":"2022-05-14T03:07:50Z","modified":"2025-04-11T04:16:21Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:14.923786Z"}],"nvd":[{"id":"CVE-2013-4450","description":"The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.","status":"published","published":"2013-10-21T17:55:03.537Z","modified":"2026-06-16T23:57:15.033Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:40.988689Z"}],"osv":[{"id":"BELL-CVE-2013-4450","title":"CVE-2013-4450 does not affect BellSoft software","status":"withdrawn","published":"2013-10-21T17:55:00Z","modified":"2026-02-18T07:35:03.886228Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2013-4450","description":"The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.","status":"published","published":"2013-10-21T17:55:03Z","modified":"2026-04-16T06:23:49.310552829Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4450","description":"The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.","status":"published","published":"2013-10-21T17:55:03.537Z","modified":"2026-09-01T20:03:18.274794898Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2014-0007","title":"Updated nodejs package fixes security vulnerabilities","description":"A denial of service flaw was found in the way Node.js handled pipelined\nHTTP requests. A remote attacker could use this flaw to send an excessive\namount of HTTP requests over a network connection, causing Node.js to use\nan excessive amount of memory and possibly exit when all available memory\nis exhausted (CVE-2013-4450).\n\nDenial of service issues in the bundled v8 JavaScript library\n(CVE-2013-6639, CVE-2013-6640).\n","status":"published","published":"2014-01-06T01:20:19Z","modified":"2026-04-16T06:24:28.218377088Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"RHSA-2013:1842","title":"Red Hat Security Advisory: nodejs010-nodejs security update","status":"published","published":"2024-09-13T08:27:34Z","modified":"2026-06-29T10:06:07Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"UBUNTU-CVE-2013-4450","description":"The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.","status":"withdrawn","published":"2013-10-21T17:55:00Z","modified":"2025-07-16T07:31:22.148636Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}