http://www.securityfocus.com/bid/106043

https://access.redhat.com/errata/RHSA-2019:1821

https://access.redhat.com/errata/RHSA-2019:2258

https://access.redhat.com/errata/RHSA-2019:3497

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

https://security.gentoo.org/glsa/202003-48

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

OR
     *cpe:2.3:a:joyent:node.js:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (including) 11.3.0
     *cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* versions from (including) 6.0.0 up to (including) 6.15.0
     *cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* versions from (including) 8.0.0 up to (including) 8.14.0
     *cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* versions from (including) 10.0.0 up to (including) 10.14.0

OR
     *cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* versions from (including) 6.0.0 up to (excluding) 6.15.0
     *cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* versions from (including) 8.0.0 up to (excluding) 8.14.0
     *cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* versions from (including) 10.0.0 up to (excluding) 10.14.0
     *cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* versions from (including) 11.0.0 up to (excluding) 11.3.0

OR
     *cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
     *cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*

https://access.redhat.com/errata/RHSA-2019:1821 No Types Assigned

https://access.redhat.com/errata/RHSA-2019:1821 Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2258 No Types Assigned

https://access.redhat.com/errata/RHSA-2019:2258 Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3497 No Types Assigned

https://access.redhat.com/errata/RHSA-2019:3497 Third Party Advisory

https://security.gentoo.org/glsa/202003-48 No Types Assigned

https://security.gentoo.org/glsa/202003-48 Third Party Advisory

https://security.gentoo.org/glsa/202003-48 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2019:3497 [No Types Assigned]

Node.js CWE-400

https://access.redhat.com/errata/RHSA-2019:2258 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2019:1821 [No Types Assigned]

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

(AV:N/AC:L/Au:N/C:N/I:N/A:P)

CWE-400

OR
     *cpe:2.3:a:joyent:node.js:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (including) 11.3.0
     *cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* versions from (including) 6.0.0 up to (including) 6.15.0
     *cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* versions from (including) 8.0.0 up to (including) 8.14.0
     *cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* versions from (including) 10.0.0 up to (including) 10.14.0

http://www.securityfocus.com/bid/106043 No Types Assigned

http://www.securityfocus.com/bid/106043 Third Party Advisory, VDB Entry

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ No Types Assigned

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ Patch, Vendor Advisory

http://www.securityfocus.com/bid/106043 [No Types Assigned]

Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.