CVE-2017-15896

Critical

Published: 11/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Node.js was affected by an OpenSSL vulnerability (CVE-2017-3737) related to the use of SSL_read() due to TLS handshake failure. An active network attacker could send application data to Node.js, bypassing TLS authentication and encryption.

Risk Assessment

An active attacker on the network could exploit this vulnerability to send data, potentially leading to the exposure of sensitive information or data manipulation.

Recommendation

It is recommended to update Node.js to the latest version that includes security patches related to this vulnerability and to monitor network traffic for potential attacks.

Original NVD description (English source)

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.