REDHAT-BUG-2431349: High severity npm/node vulnerability
A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) })
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2431349?
The severity of REDHAT-BUG-2431349 is high, rated at 7.
What does REDHAT-BUG-2431349 affect?
REDHAT-BUG-2431349 affects applications that utilize Node.js and npm.
How can REDHAT-BUG-2431349 be mitigated?
To mitigate REDHAT-BUG-2431349, you should update your Node.js and npm to the latest patched versions.
What is the impact of REDHAT-BUG-2431349?
The impact of REDHAT-BUG-2431349 is a remote denial of service due to the Node.js process crashing.
What triggers the issue described in REDHAT-BUG-2431349?
The issue described in REDHAT-BUG-2431349 is triggered by a malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data.