Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unab…

published 2020-09-18 6 y ago modified 2026-09-08 2 mo ago also BIT-node-2020-8251 , BIT-node-min-2020-8251 , EUVD-2020-29121

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 8.4%; EPSS 8.4% chance of exploitation in 30 days, percentile 94%
public exploits: 0; none known

Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.

Patch / fix

fixed in 3 distros 2

bitnami node 14.11.0
bitnami node-min 14.11.0
NodeJS Node 14.11.0

opensuse alpine

nodejs14 openSUSE Tumbleweed 14.17.5-1.2

opensuse advisories openSUSE-SU-2024:11096-1

nodejs-current Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 14.11.0-r0

alpine advisories ALPINE-CVE-2020-8251

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8251 updated 2026-11-07 cvss 7.5

nodejs: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests

Red Hat Quay 3 quay
affected: no fix available “Fix deferred”
Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Software Collections rh-nodejs10-npm, rh-nodejs12-npm, rh-nodejs10-nodejs, rh-nodejs12-nodejs
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

8.36% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	node	>=14.0.0, <14.11.0	14.11.0
bitnami	node-min	>=14.0.0, <14.11.0	14.11.0

Affected products

NodeJS Node

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

Technology feeds

Node.js rss critical rss

References

lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/
vendor-advisory, web
security.gentoo.org /glsa/202101-07
vendor-advisory, third-party-advisory, advisory
nodejs.org /en/blog/vulnerability/september-2020-security-releases/
vendor-advisory, advisory
hackerone.com /reports/868834
permissions-required, web
security.netapp.com /advisory/ntap-20201009-0004/
third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2020-8251
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary