CVE-2024-27983

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers an event-driven, non-blocking I/O model that makes it lightweight and efficient, and is widely used in web applications and server-side development.

‍

An Denial of Service vulnerability has been identified in Node.js. The issue stems from a race condition caused by improper handling of HTTP/2 frames. This weakness allows attackers to make the Node.js HTTP/2 server completely unavailable.

‍

This vulnerability affects specific versions of the package and can result in denial of service. Details on affected versions and reproduction steps are provided below.

‍

Details

Module Info

• ‍Affected packages: Node.js‍
• Affected versions: 4 <= 18.20.0, 20 <= 20.12.0‍
• GitHub repository: https://github.com/nodejs/node‍
• Published packages: https://github.com/nodejs/node/releases‍
• Package manager: npm‍
• Fixed in: Node.js NES version v12, v14, v16.
  

‍

Vulnerability Info

In a scenario where an attacker sends a small amount of HTTP/2 frames and abruptly closes the TCP connection, the system may fail to handle the frames correctly, leading to a denial of service.

This vulnerability is a result of flawed logic, and may allow attackers to completely disrupt the service.

- https://hackerone.com/reports/2319584

- https://cwe.mitre.org/data/definitions/400.html

‍

Mitigation

This vulnerability is not fixed upstream due to the release line being EOL. Herodevs has issued patched builds under the NES (Never Ending Support) line.

- Update to a patched LTS version of Node.js

- Leverage a commercial support partner like HeroDevs for post-EOL security.

Refer to the NES documentation for upgrade instructions.

‍

Credits

• bart