Описание
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24.
A flaw in the Node.js HTTP/2 API allows remote attackers to cause a Denial of Service (DoS) by sending data after a GOAWAY frame, exhausting server resources.
Отчет
This Moderate DoS flaw in the Node.js HTTP/2 API allows remote attackers to exhaust server resources and cause service unavailability by continuously sending data after a GOAWAY frame.
Меры по смягчению последствий
Restrict Node.js HTTP/2 servers to trusted clients with host firewall or network segmentation. If HTTP/2 is not required, disable the HTTP/2 server API.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | Fix deferred | ||
| Red Hat Hardened Images | nodejs20 | Not affected | ||
| Red Hat Hardened Images | nodejs22 | Not affected | ||
| Red Hat Hardened Images | nodejs24 | Not affected | ||
| Red Hat Hardened Images | nodejs25 | Not affected | ||
| Red Hat Hardened Images | nodejs26 | Not affected | ||
| Red Hat Enterprise Linux 10 | nodejs24 | Fixed | RHSA-2026:35841 | 06.07.2026 |
| Red Hat Enterprise Linux 10 | nodejs22 | Fixed | RHSA-2026:35842 | 06.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | nodejs22 | Fixed | RHSA-2026:39246 | 14.07.2026 |
| Red Hat Enterprise Linux 8 | nodejs | Fixed | RHSA-2026:39868 | 15.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
A flaw in Node.js HTTP/2 server API can cause servers to keep acceptin ...
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
EPSS
5.3 Medium
CVSS3