An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nodejs | Ubuntu | mantic | * |
| Nodejs | Ubuntu | trusty/esm | * |
| Nodejs | Ubuntu | upstream | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:20-8090020240422150739.a75119d5 | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:18-8090020240429131734.a75119d5 | * |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | RedHat | nodejs:16-8060020240515105144.ad008a3a | * |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | RedHat | nodejs:16-8060020240515105144.ad008a3a | * |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | RedHat | nodejs:16-8060020240515105144.ad008a3a | * |
| Red Hat Enterprise Linux 8.8 Extended Update Support | RedHat | nodejs:16-8080020240510090838.63b34585 | * |
| Red Hat Enterprise Linux 8.8 Extended Update Support | RedHat | nodejs:18-8080020240621122004.63b34585 | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs:18-9040020240422140329.rhel9 | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs:20-9040020240419140200.rhel9 | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs-1:16.20.2-8.el9_4 | * |
| Red Hat Enterprise Linux 9.0 Extended Update Support | RedHat | nodejs-1:16.20.2-6.el9_0 | * |
| Red Hat Enterprise Linux 9.2 Extended Update Support | RedHat | nodejs-1:16.20.2-5.el9_2.3 | * |
| Red Hat Enterprise Linux 9.2 Extended Update Support | RedHat | nodejs:18-9020020240516091141.rhel9 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-nodejs-0:14.21.3-7.el7 | * |