Red Hat Security AdvisoryRHSA-2024:3553
nodejs : security update
Released 2024-06-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.6) nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.src::nodejs:16, nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.x86_64::nodejs:16, nodejs-devel-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.x86_64::nodejs:16 +7
- Red Hat Enterprise Linux AppStream E4S (v.8.6) nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.aarch64::nodejs:16, nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.ppc64le::nodejs:16, nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.s390x::nodejs:16 +19
- Red Hat Enterprise Linux AppStream TUS (v.8.6) nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.src::nodejs:16, nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.x86_64::nodejs:16, nodejs-devel-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.x86_64::nodejs:16 +7
Fixes 1 record
Priority HIGH 84
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside.
CVSS 3.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.87211 · Published 2024-04-09 · Partial fix · 18.20.1, 20.12.1 +1 CWE-362
