An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-packaging | May 13, 2024 | Apr 9, 2024 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Jun 6, 2024 | Apr 9, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-npmUpgrade nodejs20-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade v8-11.3-develUpgrade v8-10.2-develUpgrade nodejs20-docsUpgrade nodejs20-npmUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs20-full-i18nUpgrade nodejs20-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade nodejs20Upgrade nodejs20-libsUpgrade nodejs20-develUpgrade nodejs-develUpgrade nodejs20-libs-debuginfo | Feb 17, 2025 | Apr 3, 2024 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 9, 2024 |
| Debian | — | Upgrade nodejs | Sep 16, 2024 | Apr 9, 2024 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 7, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Apr 9, 2024 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-libs | May 9, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-docsNo solution existsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-libsUpgrade nodejs-devel | May 13, 2024 | Apr 9, 2024 |
| Rocky_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-debuginfo | May 13, 2024 | Apr 9, 2024 |
| Suse | — | Upgrade nodejs12-develUpgrade npm18Upgrade nodejs14-docsUpgrade nodejs16-develUpgrade npm12Upgrade npm20Upgrade nodejs20-docsUpgrade nodejs16Upgrade corepack18Upgrade npm16Upgrade nodejs14Upgrade nodejs20Upgrade nodejs14-develUpgrade nodejs12Upgrade nodejs16-docsUpgrade nodejs18Upgrade nodejs12-docsUpgrade npm14Upgrade nodejs18-develUpgrade corepack20Upgrade nodejs18-docsUpgrade nodejs20-devel | Apr 17, 2024 | Apr 9, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 9, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub