CVE-2024-27983: Race Condition
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Other sources
At a minimum, the following versions of Node.js are affected 18, 20, and 21.
Description: An attacker can make the Node.js HTTP/2 server unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
— Red Hat
Node.js is vulnerable to a denial of service, caused by an assertion failure in node::http2::Http2Session::~Http2Session(). By sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside, an attacker could exploit this vulnerability to cause the HTTP/2 server to crash.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27983?
CVE-2024-27983 is classified as a denial-of-service vulnerability affecting Node.js HTTP/2 servers.
How do I fix CVE-2024-27983?
To mitigate CVE-2024-27983, ensure that your F5 BIG-IP and IBM Cognos Analytics software is updated to the latest patched versions.
What products are affected by CVE-2024-27983?
CVE-2024-27983 affects F5 BIG-IP versions 15.1.0 to 15.1.10, 16.1.0 to 16.1.4, and 17.1.0 to 17.1.1, as well as specific IBM Cognos Analytics versions.
Can CVE-2024-27983 lead to data loss?
CVE-2024-27983 primarily causes service unavailability, and while it may not directly lead to data loss, it can impact service accessibility.
What types of attacks exploit CVE-2024-27983?
CVE-2024-27983 can be exploited through sending a small number of malicious HTTP/2 frames to cause denial of service.