Vulnerability in Node.js Node
CVE-2024-27983
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Vulnerability class: Race Condition
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H.
EPSS exploit prediction
EPSS: 0.872 (99.8th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.872 · newest: 0.872 · change: 0.000
Affected products
- Node.js Node — versions 4.0, 5.0, 6.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- hackerone.com/reports/2319584
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/…
- www.openwall.com/lists/oss-security/2024/04/03/16
- security.netapp.com/advisory/ntap-20240510-0002/
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2024-27983?
- CVE-2024-27983 is a high-severity vulnerability in Node.js Node, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 8.2/10. Published 2024-04-09.
- How severe is CVE-2024-27983?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2024-27983 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.