UpHeron
All vulnerabilities

Servers and applications

CVE-2017-15896

Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.

Severity
Critical 9.1
Published
11 Dec 2017
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
4.8.7, 6.12.2, 8.9.3, 9.2.1
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 9.0.0 before 9.2.1
  • From 8.9.0 before 8.9.3
  • From 8.0.0 up to 8.8.1
  • From 6.9.0 before 6.12.2
All 7 release lines
  • From 4.0.0 up to 4.1.2
  • From 4.2.0 before 4.8.7
  • From 6.0.0 up to 6.8.1
  • From 6.9.0 before 6.12.2
  • From 8.0.0 up to 8.8.1
  • From 8.9.0 before 8.9.3
  • From 9.0.0 before 9.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-15896
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-15896