CVE-2024-27983

2024-04-0901:15:49

[email protected]

web.nvd.nist.gov

node.js

http/2

server

vulnerability

memory

tcp connection

race condition

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Node.js",
    "product": "Node",
    "versions": [
      {
        "version": "18.20.0",
        "status": "affected",
        "lessThanOrEqual": "18.20.0",
        "versionType": "semver"
      },
      {
        "version": "20.12.0",
        "status": "affected",
        "lessThanOrEqual": "20.12.0",
        "versionType": "semver"
      },
      {
        "version": "21.7.1",
        "status": "affected",
        "lessThanOrEqual": "21.7.1",
        "versionType": "semver"
      }
    ]
  }
]