CVE-2024-27983 is a denial-of-service vulnerability affecting Node.js HTTP/2 servers, allowing an attacker to render the server unavailable with a small number of specially crafted HTTP/2 frames. This vulnerability has a CVSS score of 8.2 (High) due to its network-based attack vector, low attack complexity, and high impact on availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating a high level of awareness. Its EPSS score and FAUCET Risk Score also suggest a high potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 18.0, < 18.20.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 20.0, < 20.12.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 21.0, < 21.7.2CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2024-27983
Jun 11, 2024An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Apr 9, 2024nodejs: CONTINUATION frames DoS
Apr 3, 2024