CVE-2019-5739

Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.

• CWE-400
• CWE-770

• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.htmlMailing List, Third Party Advisory
• https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/Vendor Advisory
• https://security.gentoo.org/glsa/202003-48Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190502-0008/Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.htmlMailing List, Third Party Advisory
• https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/Vendor Advisory
• https://security.gentoo.org/glsa/202003-48Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190502-0008/Third Party Advisory

Published

Mar 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-5729Splunk-SDK-Python before 1.6.6 does not properly verify untr…
• CVE-2019-5731Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5732Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5735Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-5736runc through 1.0-rc6, as used in Docker before 18.09.2 and o…8.6
• CVE-2019-5737In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 1…7.5
• CVE-2019-5747An issue was discovered in BusyBox through 1.30.0. An out of…7.5
• CVE-2019-5748In Traccar Server version 4.2, protocol/SpotProtocolDecoder.…
• CVE-2019-5754Implementation error in QUIC Networking in Google Chrome pri…
• CVE-2019-5755Incorrect handling of negative zero in V8 in Google Chrome p…
• CVE-2019-5756Inappropriate memory management when caching in PDFium in Go…
• CVE-2019-5757An incorrect object type assumption in SVG in Google Chrome …