{"id":"CVE-2020-8251","aliases":["ALPINE-CVE-2020-8251","BELL-CVE-2020-8251","BIT-node-2020-8251","BIT-node-min-2020-8251","EUVD-2020-29121","GHSA-9cwr-72m4-73jq","openSUSE-SU-2024:11096-1"],"status":"published","title":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests...","description":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08358,"percentile":0.95,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2020-09-18T20:11:43Z","modified":"2026-11-03T06:32:26Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["14.11.0-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["14.11.0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["14.11.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.11.0-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.11.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.11.0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-1.2"}]}],"bundled":19}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://hackerone.com/reports/868834","tags":["x_refsource_MISC","x_transferred","Permissions Required","web","report"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20201009-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202101-07","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8251","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/"},{"url":"https://github.com/advisories/GHSA-9cwr-72m4-73jq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-8251","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-8251","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3672","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-8251","description":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.","status":"published","published":"2020-09-18T20:11:43Z","modified":"2025-04-30T22:24:26.013Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-29121","description":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.","status":"published","published":"2020-09-18T20:11:43Z","modified":"2025-04-30T22:24:26Z","updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-9cwr-72m4-73jq","title":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests...","description":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.","status":"published","published":"2022-05-24T17:29:12Z","modified":"2023-01-29T05:04:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:45:29.424402Z"}],"nvd":[{"id":"CVE-2020-8251","description":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.","status":"published","published":"2020-09-18T21:15:13.403Z","modified":"2026-06-17T03:26:08.083Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:15.83396Z"}],"osv":[{"id":"ALPINE-CVE-2020-8251","description":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.","status":"published","published":"2020-09-18T21:15:13.403Z","modified":"2026-11-03T06:32:26.482578266Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"BELL-CVE-2020-8251","title":"CVE-2020-8251 does not affect BellSoft software","status":"withdrawn","published":"2020-09-18T21:15:00Z","modified":"2026-02-18T07:38:23.244165Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-8251","description":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.","status":"published","published":"2020-09-18T21:15:13.403Z","modified":"2026-10-24T10:30:23.632063756Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"BIT-node-2020-8251","description":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.","status":"published","published":"2024-03-06T11:07:59.893Z","modified":"2026-09-08T08:48:17.407922655Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2020-8251","description":"Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.","status":"published","published":"2024-12-16T14:06:53.531Z","modified":"2026-09-08T08:48:16.977869486Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"openSUSE-SU-2024:11096-1","title":"nodejs14-14.17.5-1.2 on GA media","description":"These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:56.833198Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}