Internet Bug Bounty · Report #2453328
Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash
Summary
Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash (CVE-2024-27983) - (High) An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Impacts:
This vulnerability affects all users in all active release lines: 18.x, 20.x and, 21.x.
Thank you, to bart for reporting this vulnerability and Anna Henningsen for fixing it.
Full Security Advisory: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases
How it was found
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
- Advisory: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases
- HackerOne report: 2319584
Impact
Server crashes instantly after sending a few HTTP/2 frames.