CVE-2024-27983-nodejs-http2

本仓库基于 CVE-2024-27983 构建了一个易受攻击的 HTTP2 Node.js 服务器（server-nossl.js），该 CVE 利用了 HTTP2 服务器中的 continuation flood 漏洞。 说明： server.js 因使用 SSL 证书而被认定为不受该漏洞影响。 server-nossl.js 易受 continuation flood 攻击。 client.js 是一个用于测试 HTTP2 服务器的小型客户端脚本。 exploits/ 包含基于 HackerOne 报告 的漏洞利用代码。 贡献 请参阅 CONTRIBUTING 了解如何为本项目做出贡...

Linux Distros Unpatched Vulnerability : CVE-2026-56848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a...

CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24...