CVE-2024-27983 — NodeJS / Node

Description (CNA)

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

Affected (CNA)

Vendor / product	Versions
NodeJS / Node	affected 4.0 before 4.; affected 5.0 before 5.; affected 6.0 before 6.; affected 7.0 before 7.; affected 8.0 before 8.; affected 9.0 before 9.; affected 10.0 before 10.; affected 11.0 before 11.; affected 12.0 before 12.; affected 13.0 before 13.; affected 14.0 before 14.; affected 15.0 before 15.; affected 16.0 before 16.; affected 17.0 before 17.; affected 18.0 before 18.20.1; affected 19.0 before 19.*; affected 20.0 before 20.12.1; affected 21.0 before 21.7.2

Vendor / product

Versions

NodeJS / Node

affected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.*; affected 13.0 before 13.*; affected 14.0 before 14.*; affected 15.0 before 15.*; affected 16.0 before 16.*; affected 17.0 before 17.*; affected 18.0 before 18.20.1; affected 19.0 before 19.*; affected 20.0 before 20.12.1; affected 21.0 before 21.7.2

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.