Uncontrolled resource consumption in NodeJS Node
Priority MEDIUM 44CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.
Summary
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
Why it matters now
EPSS 0.08358 94th percentileScored 2026-11-07
Fix Partial Node (NodeJS): 14.11.0Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NodeJS | Node | 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 11.0 and later; 13.0 and later; 14.0 to before 14.11.0 | 14.11.0 | Patch available | CNA |
- Node VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 11.0 and later; 13.0 and later; 14.0 to before 14.11.0 Fixed in 14.11.0 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | 14.0.0 to before 14.11.0 | Vulnerable | NodeJS |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
- cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* Versions 14.0.0 to before 14.11.0 Vulnerable ·NodeJS
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA Node (NodeJS) Fixed in 14.11.0
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8251
- 2026-10-03 Alias added: GHSA-9cwr-72m4-73jq
References
More NodeJS Node.js vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
- TI-2022-03315 X.509 Email Address 4-byte Buffer Overflow CVSS 3.1HIGH 7.5
Sources
- CVE-2020-8251 · CVE Program
- CVE-2020-8251 · NVD
- FIRST EPSS
- GHSA-9cwr-72m4-73jq · GitHub Advisory Database · CC BY 4.0
- CVE-2020-8251 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences