{
  "cve": [
    "CVE-2024-27983"
  ],
  "vulnerable": "18.x || 20.x || 21.x",
  "patched": "^18.20.1 || ^20.12.1 || ^21.7.2",
  "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/",
  "description": "Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash",
  "overview": "An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.",
  "affectedEnvironments": [
    "all"
  ],
  "severity": "high"
}