CVE-2018-7164: Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM.

Security readout for executives and security teams

This is a Node.js denial-of-service issue. A network peer sending many very small chunks can cause affected Node.js versions to use extra memory when applications read network data through net.Socket streams. The sources do not indicate data theft, privilege escalation, or confirmed active exploitation. Exposure is most likely in internet-facing or untrusted-network Node.js services running affected 9.x or 10.x versions and using net.Socket directly as a stream. Services not accepting untrusted network input, or not using the affected stream path, have lower apparent exposure. Treat this as a moderate availability risk. Prioritize externally reachable Node.js services, especially older 9.x or 10.x deployments. Remediation should be scheduled promptly but below issues enabling code execution, credential theft, or confirmed exploited vulnerabilities. Mitigation focus: Inventory Node.js runtimes and flag 9.7.0+ 9.x and 10.x deployments.; Apply the relevant Node.js June 2018 security release or vendor package update.; Review Gentoo systems for GLSA-202003-48 package guidance where applicable..

Prepared

Jun 7, 2026, 13:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.