CVE-2018-7161 Use after free in Node.js
An attacker can crash an HTTP/2 server by triggering a use-after-free bug in the Node.js runtime, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-7161?
CVE-2018-7161 is a high-severity use after free vulnerability in Nodejs Node.js, published on 13 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.
Weakness: CWE-20
Which versions are affected by CVE-2018-7161?
It affects 1 product.
Products include Nodejs Node.js.
How do I fix CVE-2018-7161?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2018-7161 being exploited?
There is no known exploitation of CVE-2018-7161 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as ALPINE-CVE-2018-7161, CLEANSTART-2026-BY44512, CLEANSTART-2026-SI43260, DEBIAN-CVE-2018-7161, GHSA-jfr7-p3h5-mh28, UBUNTU-CVE-2018-7161.