CVE-2024-27983

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-27983
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27983.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-27983
Aliases
Downstream
Related
Published
2024-04-09T01:15:49Z
Modified
2025-08-29T19:01:39Z
Summary
[none]
Details

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

References

Affected packages