PT-2024-2622 · Node.Js+8 · Node.Js+8
Bart
+1
·
Published
2023-07-31
·
Updated
2026-05-18
·
CVE-2024-27983
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
Node.js (affected versions not specified)
Description
The issue is related to the Node.js HTTP/2 server, where an attacker can make the server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. This can cause a race condition when headers with HTTP/2 CONTINUATION frames are sent to the server and then a TCP connection is abruptly closed by the client, triggering the
Http2Session destructor while header frames are still being processed. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Race Condition
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Node.Js
Red Hat
Red Os
Rocky Linux
Suse