Описание
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24.
A flaw in the Node.js HTTP/2 API allows remote attackers to cause a Denial of Service (DoS) by sending data after a GOAWAY frame, exhausting server resources.
Отчет
This Moderate DoS flaw in the Node.js HTTP/2 API allows remote attackers to exhaust server resources and cause service unavailability by continuously sending data after a GOAWAY frame.
Меры по смягчению последствий
Restrict Node.js HTTP/2 servers to trusted clients with host firewall or network segmentation. If HTTP/2 is not required, disable the HTTP/2 server API.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | nodejs22 | Not affected | ||
| Red Hat Enterprise Linux 10 | nodejs24 | Not affected | ||
| Red Hat Enterprise Linux 8 | nodejs:22/nodejs | Not affected | ||
| Red Hat Enterprise Linux 8 | nodejs:24/nodejs | Not affected | ||
| Red Hat Enterprise Linux 9 | nodejs:22/nodejs | Not affected | ||
| Red Hat Enterprise Linux 9 | nodejs:24/nodejs | Not affected | ||
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | Not affected | ||
| Red Hat Hardened Images | nodejs20 | Not affected | ||
| Red Hat Hardened Images | nodejs22 | Not affected | ||
| Red Hat Hardened Images | nodejs24 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
A flaw in Node.js HTTP/2 server API can cause servers to keep acceptin ...
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.
EPSS
5.3 Medium
CVSS3