A vuneability was found in Node.js in which keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default. Reference: https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/
Created nodejs tracking bugs for this issue: Affects: epel-7 [bug 1690817]
Created nodejs tracking bugs for this issue: Affects: fedora-28 [bug 1690818]
According to the External Reference (https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/) nodejs 8 and nodejs 10 are not vulnerable to this flaw.
External References: https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/