CVE-2024-27983: Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Other sources
At a minimum, the following versions of Node.js are affected 18, 20, and 21.
Description: An attacker can make the Node.js HTTP/2 server unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
— Red Hat
Node.js is vulnerable to a denial of service, caused by an assertion failure in node::http2::Http2Session::~Http2Session(). By sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside, an attacker could exploit this vulnerability to cause the HTTP/2 server to crash.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.117.1.2.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.14.0-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.18.2-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.1Fixed in 20.12.1Fixed in 21.7.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.12.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.7.2 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.1+dfsg-1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.21.0+dfsg+~cs24.13.4-1Fixed in 24.22.2+dfsg+~cs24.19.2-1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 18.20.1-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 20.12.1-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 21.7.2-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-27983?
CVE-2024-27983 is classified as a denial-of-service vulnerability affecting Node.js HTTP/2 servers.
How do I fix CVE-2024-27983?
To mitigate CVE-2024-27983, ensure that your F5 BIG-IP and IBM Cognos Analytics software is updated to the latest patched versions.
What products are affected by CVE-2024-27983?
CVE-2024-27983 affects F5 BIG-IP versions 15.1.0 to 15.1.10, 16.1.0 to 16.1.4, and 17.1.0 to 17.1.1, as well as specific IBM Cognos Analytics versions.
Can CVE-2024-27983 lead to data loss?
CVE-2024-27983 primarily causes service unavailability, and while it may not directly lead to data loss, it can impact service accessibility.
What types of attacks exploit CVE-2024-27983?
CVE-2024-27983 can be exploited through sending a small number of malicious HTTP/2 frames to cause denial of service.