Port reference
Port 5984 (TCP) – Apache CouchDB
Default port for the Apache CouchDB HTTP/REST API used to store and query JSON documents.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Older CouchDB ran in 'admin party' mode with no administrator and no authentication, and could bind to 0.0.0.0, so anyone reaching 5984 had full read/write/admin access.
What is port 5984 used for?
Port 5984 is the default port for the Apache CouchDB HTTP/REST API. CouchDB is a document database that stores data as JSON documents, and it exposes everything — queries, document storage, replication, and admin — over plain HTTP on this port. Applications talk to it with ordinary HTTP requests, and tools like curl, the built-in Fauxton web UI, and CouchDB client libraries connect here.
When would you open it?
Open or forward port 5984 only when you run a CouchDB server that other machines or apps genuinely need to reach, such as a backend service or a replication partner. If CouchDB is only used by software on the same host, leave it bound to localhost and keep the port closed.
Is it safe to open?
CouchDB is administered over HTTP, so an exposed port can mean full read/write access to your data; require authentication, use TLS, and limit access to trusted hosts. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5984
nmap -p 5984 <target>netstat -ano | findstr :5984
Test-NetConnection <host> -Port 5984lsof -i :5984
nmap -p 5984 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5984 to your device's local IP, internal port 5984, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5984/tcpsudo firewall-cmd --permanent --add-port=5984/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5984 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5984" -Direction Inbound -Protocol TCP -LocalPort 5984 -Action AllowSecurity & risks
Common attacks
- Unauthenticated REST access ('admin party') to read, modify, or delete all databases
- CVE-2017-12635 privilege escalation to gain admin via crafted role JSON
- CVE-2017-12636 remote code execution via config/query server abuse
- Ransom attacks that wipe databases and leave a payment note
Hardening
- Create an admin and disable admin party; require authentication
- Bind to localhost or a private interface; never expose 5984 to the internet
- Require TLS and firewall to trusted hosts only
- Patch CouchDB and Erlang to fix CVE-2017-12635/12636
- Restrict the config and query-server interfaces
How to block this port
sudo ufw deny 5984/tcpsudo firewall-cmd --permanent --remove-port=5984/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5984 -j DROPNew-NetFirewallRule -DisplayName "Block 5984" -Direction Inbound -Protocol TCP -LocalPort 5984 -Action Blocknmap snippet
nmap -p5984 --script http-title <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is CouchDB 'admin party' mode?
- By default older CouchDB had no admin user, so every client had full administrative rights over the HTTP API. Create an admin account immediately, require authentication, and bind to localhost.
- How serious were CVE-2017-12635 and CVE-2017-12636?
- Very. CVE-2017-12635 let an attacker escalate to admin via a crafted role document, and CVE-2017-12636 chained to remote code execution. Patch CouchDB and restrict access to port 5984.