Vulnerability · Published Apr 9, 2024 · Assigned by hackerone
CVE-2024-27983
High 8.2
In plain English
A high-severity race condition in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 87.2% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)8.2High
Exploit odds (30 days)87.2%top 0.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:8 | nodejs-devel | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:8 | nodejs-devel | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:9 | nodejs-devel | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-devel | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:8 | nodejs-docs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-docs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-docs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | nodejs-docs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-docs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:8 | nodejs-full-i18n | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-full-i18n | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-full-i18n | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | nodejs-full-i18n | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-libs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 | ALSA-2024:2853 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:2778 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 |
| AlmaLinux:8 | npm | 1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | npm | 1:10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | npm | 1:10.5.0-1.20.12.2.2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | npm | 1:10.5.0-1.18.20.2.2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 | ALSA-2024:2910 |
| Alpine:v3.20 | nodejs | 20.12.1-r0 | ALPINE-CVE-2024-27983 |
| Alpine:v3.21 | nodejs | 20.12.1-r0 | ALPINE-CVE-2024-27983 |
| Alpine:v3.22 | nodejs | 20.12.1-r0 | ALPINE-CVE-2024-27983 |
| Alpine:v3.23 | nodejs | 20.12.1-r0 | ALPINE-CVE-2024-27983 |
| Alpine:v3.24 | nodejs | 20.12.1-r0 | ALPINE-CVE-2024-27983 |
| Alpine:v3.20 | nodejs-current | 21.7.2-r0 | ALPINE-CVE-2024-27983 |
| Alpine:v3.21 | nodejs-current | 21.7.2-r0 | ALPINE-CVE-2024-27983 |
| Alpine:v3.22 | nodejs-current | 21.7.2-r0 | ALPINE-CVE-2024-27983 |
| Alpine:v3.23 | nodejs-current | 21.7.2-r0 | ALPINE-CVE-2024-27983 |
| Alpine:v3.24 | nodejs-current | 21.7.2-r0 | ALPINE-CVE-2024-27983 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DEBIAN-CVE-2024-27983 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DSA-5991-1 |
| Debian:13 | nodejs | 18.20.1+dfsg-1 | DEBIAN-CVE-2024-27983 |
| Debian:14 | nodejs | 18.20.1+dfsg-1 | DEBIAN-CVE-2024-27983 |
| Rocky Linux:8 | nodejs | 1:18.20.2-1.module+el8.9.0+1803+9ac8b495 | RLSA-2024:2780 |
| Rocky Linux:8 | nodejs | 1:20.12.2-2.module+el8.9.0+1804+2708cc21 | RLSA-2024:2778 |
| Rocky Linux:9 | nodejs | 1:16.20.2-8.el9_4 | RLSA-2024:2910 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2780 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2778 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:2853 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2780 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2778 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:2853 |
| Ubuntu:24.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2024-27983 |
Affected products (as reported)
Weakness: CWE-362 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- https://hackerone.com/reports/2319584
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YDVFUH7ACZPYB3BS4SVILNOY7NQU73VW/
- http://www.openwall.com/lists/oss-security/2024/04/03/16
- https://security.netapp.com/advisory/ntap-20240510-0002/
- https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html
- https://www.kb.cert.org/vuls/id/421644