CVE-2017-14919

Published: Oct 30, 2017Modified: Jul 14, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.

Affected (23)

Products: Nodejs: Node.js

Nodejs

1 product

Node.js

Configuration A

23 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	Version 4.8.2
Nodejs Node.js	Version 4.8.3
Nodejs Node.js	Version 4.8.4
Nodejs Node.js	Version 6.10.2
Nodejs Node.js	Version 6.10.3
Nodejs Node.js	Version 6.11.0
Nodejs Node.js	Version 6.11.1
Nodejs Node.js	Version 6.11.2
Nodejs Node.js	Version 6.11.3
Nodejs Node.js	Version 6.11.4
Nodejs Node.js	Version 8.0.0
Nodejs Node.js	Version 8.1.0
Nodejs Node.js	Version 8.1.1
Nodejs Node.js	Version 8.1.2
Nodejs Node.js	Version 8.1.3
Nodejs Node.js	Version 8.1.4
Nodejs Node.js	Version 8.2.0
Nodejs Node.js	Version 8.2.1
Nodejs Node.js	Version 8.3.0
Nodejs Node.js	Version 8.4.0
Nodejs Node.js	Version 8.5.0
Nodejs Node.js	Version 8.6.0
Nodejs Node.js	Version 8.7.0