An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-devel | May 13, 2024 | Apr 9, 2024 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Jun 6, 2024 | Apr 9, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-develUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-develUpgrade nodejs20-full-i18nUpgrade v8-11.3-develUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-npmUpgrade nodejs20-debuginfoUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs20-npmUpgrade nodejs20-docsUpgrade nodejs20Upgrade nodejs20-libsUpgrade v8-10.2-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs20-debugsourceUpgrade nodejs-libs | Feb 17, 2025 | Apr 3, 2024 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 9, 2024 |
| Debian | — | Upgrade nodejs | Sep 16, 2024 | Apr 9, 2024 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 7, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Apr 9, 2024 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-libs | May 9, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-packagingNo solution existsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-docsUpgrade npmUpgrade nodejs-develUpgrade nodejs-libs | May 13, 2024 | Apr 9, 2024 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-devel | May 13, 2024 | Apr 9, 2024 |
| Suse | — | Upgrade nodejs18Upgrade nodejs12Upgrade npm14Upgrade nodejs14-develUpgrade nodejs16-docsUpgrade npm16Upgrade nodejs18-docsUpgrade nodejs20Upgrade nodejs18-develUpgrade corepack18Upgrade nodejs12-docsUpgrade nodejs20-develUpgrade nodejs14Upgrade corepack20Upgrade npm20Upgrade nodejs16-develUpgrade npm18Upgrade nodejs16Upgrade nodejs20-docsUpgrade nodejs12-develUpgrade npm12Upgrade nodejs14-docs | Apr 17, 2024 | Apr 9, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 9, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub