An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-develUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-libs | May 13, 2024 | Apr 9, 2024 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Jun 6, 2024 | Apr 9, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-develUpgrade nodejs20-develUpgrade nodejs20-libs-debuginfoUpgrade nodejs-npmUpgrade v8-11.3-develUpgrade nodejs20-debugsourceUpgrade nodejs20-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs20-npmUpgrade nodejs20-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs20-libsUpgrade nodejs20Upgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade v8-10.2-develUpgrade nodejs20-full-i18nUpgrade nodejsUpgrade nodejs-docs | Feb 17, 2025 | Apr 3, 2024 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 9, 2024 |
| Debian | — | Upgrade nodejs | Sep 16, 2024 | Apr 9, 2024 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 7, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Apr 9, 2024 |
| Oracle_linux | — | Upgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade npmUpgrade nodejs-full-i18n | May 9, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade nodejs-libsUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debugsourceNo solution existsUpgrade nodejs-packaging-bundlerUpgrade nodejs | May 13, 2024 | Apr 9, 2024 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-full-i18n | May 13, 2024 | Apr 9, 2024 |
| Suse | — | Upgrade npm20Upgrade npm18Upgrade nodejs20-docsUpgrade nodejs16Upgrade nodejs14-docsUpgrade nodejs12-develUpgrade nodejs16-develUpgrade npm12Upgrade nodejs20-develUpgrade npm14Upgrade corepack18Upgrade nodejs14Upgrade npm16Upgrade nodejs18Upgrade nodejs14-develUpgrade nodejs12Upgrade nodejs20Upgrade nodejs12-docsUpgrade nodejs18-docsUpgrade nodejs16-docsUpgrade corepack20Upgrade nodejs18-devel | Apr 17, 2024 | Apr 9, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 9, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub