CVE-2017-14919

HighCVSS 7.5

Published: 30/10/2017(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

8.14%

94th percentile - higher than 94% of all known CVEs

Summary

A vulnerability in Node.js before versions 4.8.5, 6.11.5, and 8.8.0 allows a remote attacker to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 that makes 8 an invalid value for the windowBits parameter.

Risk Assessment

An unauthenticated remote attacker can trigger a denial of service, potentially causing application downtime and loss of availability.

Recommendation

Immediately upgrade Node.js to version 4.8.5, 6.11.5, 8.8.0 or later to remediate the vulnerability.

Original NVD description (English source)

Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.