CVE-2024-27983

Name of the Vulnerable Software and Affected Versions Node.js (affected versions not specified)

Description The issue is related to the Node.js HTTP/2 server, where an attacker can make the server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. This can cause a race condition when headers with HTTP/2 CONTINUATION frames are sent to the server and then a TCP connection is abruptly closed by the client, triggering the Http2Session destructor while header frames are still being processed. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.