{"id":"CVE-2019-5739","aliases":["DEBIAN-CVE-2019-5739","EUVD-2019-15312","GHSA-wr35-fh22-q84x","MGASA-2019-0277","SUSE-SU-2019:0658-1","SUSE-SU-2019:0818-1","UBUNTU-CVE-2019-5739"],"status":"published","title":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js...","description":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04929,"percentile":0.92191,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2019-03-20T13:32:01Z","modified":"2026-10-24T10:30:38Z","fixes":[{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["8.9.3~dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["8.9.3~dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["8.9.3~dfsg-5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.3~dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.3~dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.3~dfsg-5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-8.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"http-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-15.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-15.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-11.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-11.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-11.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.0-11.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]}],"products":[{"vendor":"node.js","product":"node.js"},{"vendor":"nodejs","product":"node.js"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190502-0008/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202003-48","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5739"},{"url":"https://github.com/advisories/GHSA-wr35-fh22-q84x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-5739","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0277.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21330","tags":["report"]},{"url":"https://nodejs.org/en/blog/release/v6.11.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.11.4/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.12.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.13.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.13.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.14.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.15.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.15.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.16.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.17.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v6.17.1/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190658-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1127080","tags":["report"]},{"url":"https://bugzilla.suse.com/1127532","tags":["report"]},{"url":"https://bugzilla.suse.com/1127533","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5739","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190818-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-5739","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-5739","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-5739","description":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.","status":"published","published":"2019-03-28T16:27:34Z","modified":"2024-08-04T20:01:52.297Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:18.411291Z"}],"euvd":[{"id":"EUVD-2019-15312","description":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.","status":"published","published":"2019-03-28T16:27:34Z","modified":"2024-08-04T20:01:52Z","updated_at":"2026-11-03T03:06:51.340672Z"}],"ghsa":[{"id":"GHSA-wr35-fh22-q84x","title":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js...","description":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.","status":"published","published":"2022-05-13T01:14:31Z","modified":"2023-02-01T05:04:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:50:09.415947Z"}],"nvd":[{"id":"CVE-2019-5739","description":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.","status":"published","published":"2019-03-28T17:29:01.647Z","modified":"2026-06-17T02:38:07.953Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-5739","description":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.","status":"published","published":"2019-03-28T17:29:01.647Z","modified":"2026-10-24T10:30:38.376901192Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-5739","description":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.","status":"published","published":"2019-03-28T17:29:01.647Z","modified":"2026-09-21T07:00:43.072108169Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-5739","description":"Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.","status":"published","published":"2019-03-28T17:29:00Z","modified":"2026-04-22T12:10:15.998763Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"MGASA-2019-0277","title":"Updated nodejs packages fix security vulnerabilities","description":"This update provides nodejs v6.17.1 fixing at least the following security\nissues:\n\nThe c-ares function ares_parse_naptr_reply(), which is used for parsing\nNAPTR responses, could be triggered to read memory outside of the given\ninput buffer (CVE-2017-1000381) \n\nFix for 'path' module regular expression denial of service (CVE-2018-7158)\n\nReject spaces in HTTP Content-Length header values (CVE-2018-7159)\n\nFix for inspector DNS rebinding vulnerability (CVE-2018-7160)\n\nbuffer: Fixes Denial of Service vulnerability where calling Buffer.fill()\ncould hang (CVE-2018-7167)\n\nbuffer: Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding\n(CVE-2018-12115)\n\nNode.js: HTTP request splitting (CVE-2018-12116)\n\nNode.js: Debugger port 5858 listens on any interface by default\n(CVE-2018-12120)\n\nNode.js: Denial of Service with large HTTP headers (CVE-2018-12121)\n\nNode.js: Slowloris HTTP Denial of Service (CVE-2018-12122)\n\nNode.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)\n\nNode.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)\n\nNode.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)\n\nFor other fixes in this update, see the referenced release logs.\n","status":"published","published":"2019-09-15T13:24:16Z","modified":"2026-04-16T04:41:44.565194424Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"SUSE-SU-2019:0658-1","title":"Security update for nodejs4","description":"This update for nodejs4 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service \n  when HTTP connection are kept active (bsc#1127533).\n- CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service\n  when HTTP connection are kept active (bsc#1127532).\n- CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances \n  a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).\t  \n","status":"published","published":"2019-03-20T13:32:01Z","modified":"2026-02-04T04:09:01.031708Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0818-1","title":"Security update for nodejs6","description":"This update for nodejs6 to version 6.17.0 fixes the following issues:\n\nSecurity issues fixed:\n\n\n- CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service \n  when HTTP connection are kept active (bsc#1127533).\n- CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service\n  when HTTP connection are kept active (bsc#1127532).\n- CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances \n  a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).\n\nRelease Notes: https://nodejs.org/en/blog/release/v6.17.0/    \n","status":"published","published":"2019-03-29T17:03:45Z","modified":"2026-02-04T03:23:42.211174Z","updated_at":"2026-11-02T15:53:45.926331Z"}]}}