Race condition in NodeJS Node
Priority HIGH 84CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Partial Red Hat: 10 fixed, 1 without a fix
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat.
Summary
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.87211 99th percentileScored 2026-11-07
Fix Partial Node (NodeJS): 18.20.1, 20.12.1, 21.7.2Red Hat: 12 advisoriesRed Hat: 10 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NodeJS | Node | 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 and later; 15.0 and later; 16.0 and later; 17.0 and later; 18.0 to before 18.20.1; 19.0 and later; 20.0 to before 20.12.1; 21.0 to before 21.7.2 | 18.20.1, 20.12.1, 21.7.2 | Patch available | CNA |
- Node VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 and later; 15.0 and later; 16.0 and later; 17.0 and later; 18.0 to before 18.20.1; 19.0 and later; 20.0 to before 20.12.1; 21.0 to before 21.7.2 Fixed in 18.20.1, 20.12.1, 21.7.2 Patch available CNA
Remediation
- Fix · CNA Node (NodeJS) Fixed in 18.20.1, 20.12.1, 21.7.2
Red Hat 12 advisories
- RHSA-2024:4824 Released 2024-07-24 · Red Hat rating Importantnodejs:18 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) nodejs-1:18.19.1-3.module+el8.8.0+22005+6f8bb252.aarch64::nodejs:18, nodejs-1:18.19.1-3.module+el8.8.0+22005+6f8bb252.ppc64le::nodejs:18, nodejs-1:18.19.1-3.module+el8.8.0+22005+6f8bb252.s390x::nodejs:18 +20
- RHSA-2024:4353 Released 2024-07-08 · Red Hat rating Importantnodejs:16 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) nodejs-1:16.20.2-4.module+el8.8.0+21791+70c4808d.1.aarch64::nodejs:16, nodejs-1:16.20.2-4.module+el8.8.0+21791+70c4808d.1.ppc64le::nodejs:16, nodejs-1:16.20.2-4.module+el8.8.0+21791+70c4808d.1.s390x::nodejs:16 +19
- RHSA-2024:3544 Released 2024-06-03 · Red Hat rating Importantnodejs:18 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) nodejs-1:18.20.2-2.module+el9.2.0+21812+f1e61652.aarch64::nodejs:18, nodejs-1:18.20.2-2.module+el9.2.0+21812+f1e61652.ppc64le::nodejs:18, nodejs-1:18.20.2-2.module+el9.2.0+21812+f1e61652.s390x::nodejs:18 +20
Show 9 more Red Hat advisories
- RHSA-2024:3545 Released 2024-06-03 · Red Hat rating Importantnodejs security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) nodejs-1:16.20.2-6.el9_0, nodejs-docs-1:16.20.2-6.el9_0, nodejs-full-i18n-1:16.20.2-6.el9_0 +2
- RHSA-2024:3553 Released 2024-06-03 · Red Hat rating Importantnodejs : security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.src::nodejs:16, nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.x86_64::nodejs:16, nodejs-devel-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.x86_64::nodejs:16 +7
- Red Hat Enterprise Linux AppStream E4S (v.8.6) nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.aarch64::nodejs:16, nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.ppc64le::nodejs:16, nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.s390x::nodejs:16 +19
- Red Hat Enterprise Linux AppStream TUS (v.8.6) nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.src::nodejs:16, nodejs-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.x86_64::nodejs:16, nodejs-devel-1:16.20.2-5.module+el8.6.0+21811+5a4561ff.x86_64::nodejs:16 +7
- RHSA-2024:3472 Released 2024-05-29 · Red Hat rating Importantrh-nodejs14 security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.21.3-7.el7, rh-nodejs14-nodejs-devel-14.21.3-7.el7, rh-nodejs14-nodejs-docs-14.21.3-7.el7 +2
- Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.21.3-7.el7, rh-nodejs14-nodejs-devel-14.21.3-7.el7, rh-nodejs14-nodejs-docs-14.21.3-7.el7 +2
- RHSA-2024:2937 Released 2024-05-21 · Red Hat rating Importantnodejs security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) nodejs-1:16.20.2-5.el9_2.3, nodejs-docs-1:16.20.2-5.el9_2.3, nodejs-full-i18n-1:16.20.2-5.el9_2.3 +2
- RHSA-2024:2910 Released 2024-05-20 · Red Hat rating Importantnodejs security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.20.2-8.el9_4, nodejs-docs-1:16.20.2-8.el9_4, nodejs-full-i18n-1:16.20.2-8.el9_4 +2
- RHSA-2024:2853 Released 2024-05-15 · Red Hat rating Importantnodejs:20 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:20.12.2-2.module+el9.4.0+21731+46b5b8a7.aarch64::nodejs:20, nodejs-1:20.12.2-2.module+el9.4.0+21731+46b5b8a7.ppc64le::nodejs:20, nodejs-1:20.12.2-2.module+el9.4.0+21731+46b5b8a7.s390x::nodejs:20 +20
- RHSA-2024:2780 Released 2024-05-09 · Red Hat rating Importantnodejs:18 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.20.2-1.module+el8.9.0+21767+537f34ee.aarch64::nodejs:18, nodejs-1:18.20.2-1.module+el8.9.0+21767+537f34ee.ppc64le::nodejs:18, nodejs-1:18.20.2-1.module+el8.9.0+21767+537f34ee.s390x::nodejs:18 +20
- RHSA-2024:2778 Released 2024-05-09 · Red Hat rating Importantnodejs:20 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.12.2-2.module+el8.9.0+21743+0b3f1be2.aarch64::nodejs:20, nodejs-1:20.12.2-2.module+el8.9.0+21743+0b3f1be2.ppc64le::nodejs:20, nodejs-1:20.12.2-2.module+el8.9.0+21743+0b3f1be2.s390x::nodejs:20 +20
- RHSA-2024:2779 Released 2024-05-09 · Red Hat rating Importantnodejs:18 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.20.2-2.module+el9.4.0+21742+692df1ea.aarch64::nodejs:18, nodejs-1:18.20.2-2.module+el9.4.0+21742+692df1ea.ppc64le::nodejs:18, nodejs-1:18.20.2-2.module+el9.4.0+21742+692df1ea.s390x::nodejs:18 +20
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:2778, RHSA-2024:2780 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:2779, RHSA-2024:2853, RHSA-2024:2910 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2024:3553 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2024:3553 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:4353, RHSA-2024:4824 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2024:3545 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:2937, RHSA-2024:3544 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2024:3553 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2024:3472 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2024:3472 |
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27983
- 2026-10-03 Alias added: GHSA-j65r-8hrg-qc6x
References
Other 5
- https://hackerone.com/reports/2319584
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YDVFUH7ACZPYB3BS4SVILNOY7NQU73VW/
- http://www.openwall.com/lists/oss-security/2024/04/03/16
- https://security.netapp.com/advisory/ntap-20240510-0002/
More NodeJS vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
- TI-2022-03315 X.509 Email Address 4-byte Buffer Overflow CVSS 3.1HIGH 7.5
Sources
- CVE-2024-27983 · CVE Program
- CVE-2024-27983 · NVD
- FIRST EPSS
- GHSA-j65r-8hrg-qc6x · GitHub Advisory Database · CC BY 4.0
- CVE-2024-27983 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences