CVE-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

CVSS v3.0

8.2 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

EPSS

87.21% chance of exploitation in the next 30 days, 100th percentile

Published

2024-04-09

Updated

2025-11-04

Proof-of-concept exploits (2)

• PsychoPunkSage/Chronark2★ · 2026-01-21
• lirantal/CVE-2024-27983-nodejs-http27★ · 2026-06-12

References

• CVE Record
• NVD entry

Related

• CVE-2020-7921
• CVE-2022-24834
• CVE-2019-10760
• CVE-2020-7598
• CVE-2024-21532
• CVE-2024-21533