Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2024-27983

High

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside.

Published Apr 9, 2024 · Updated Aug 27, 2026 · Also known as ALPINE-CVE-2024-27983, BIT-node-2024-27983, BIT-node-min-2024-27983, DEBIAN-CVE-2024-27983, ROOT-OS-DEBIAN-12-CVE-2024-27983, UBUNTU-CVE-2024-27983

Key Facts

Patch immediately
  • CVE-2024-27983 is a high-severity vulnerability (CVSS 8.2 v3.1) affecting nodejs (alpine), nodejs-current (alpine), Node (bitnami) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 87% probability of exploitation in the next 30 days.
  • Fixed versions are available, including corepack18 18.20.1-150400.9.21.3, corepack20 20.12.1-1.1, corepack20 20.12.1-150500.11.9.2.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

8.2

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

EPSS (30-day exploit likelihood)

87%

Higher than 99.7% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2024-27983 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

Affected Products

272 affected entries in total
ProductAffected versionsFixed in
nodejsalpineSee advisory18.20.1-r0
nodejs-currentalpineSee advisory21.7.2-r0
Nodebitnami>= 4.018.20.1
node-minbitnamiSee advisory18.20.1
rootio-nodejsrootioSee advisory18.20.4+dfsg-1~deb12u1
20 more affected products in the full CVE brief

Patched Releases

corepack18

18.20.1-150400.9.21.3

corepack20

20.12.1-1.1, 20.12.1-150500.11.9.2

corepack21

21.7.2-1.1

Node

18.20.1, 20.12.1, 21.7.2, 10.*, 11.*, 12.*, 13.*, 14.*, 15.*, 16.*, 17.*, 19.*, 4.*, 5.*, 6.*, 7.*, 8.*, 9.*

node-min

18.20.1, 20.12.1, 21.7.2

nodejs

1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644, 1:10.5.0-1.20.12.2.2.module_el9.4.0+100+71fc9528, 1:16.20.2-8.0.1.el9_4, 1:16.20.2-8.el9_4, 1:18.18.2-1.amzn2023.0.4, 1:18.20.2-1.module+el8.9.0+1803+9ac8b495, 1:18.20.2-1.module+el8.9.0+90319+0b1e7189, 1:18.20.2-1.module+el9.4.0+90321+c72a88c5, 1:18.20.2-2.module_el9.4.0+99+a01f7676, 1:20.12.2-2.module_el8.9.0+3827+11b91f3e, 1:20.12.2-2.module+el8.9.0+1804+2708cc21, 1:20.12.2-2.module+el8.9.0+90318+7fb2e04b, 1:20.12.2-2.module+el9.4.0+90322+0b80090c, 1:8.19.4-1.16.20.2.8.el9_4, 12.22.12~dfsg-1~deb11u5, 18.20.1, 18.20.1-r0, 18.20.1+dfsg-1, 18.20.3-1.ph4, 18.20.4+dfsg-1~deb12u1, 20.12.1-1.ph5, 20.12.1-r0, 20.14.0-1

nodejs-current

21.7.2-r0

nodejs-devel

1:18.18.2-1.amzn2023.0.4, 1:18.20.2-1.module+el8.9.0+90319+0b1e7189, 1:18.20.2-1.module+el9.4.0+90321+c72a88c5, 1:20.12.2-2.module+el8.9.0+90318+7fb2e04b, 1:20.12.2-2.module+el9.4.0+90322+0b80090c, 18.20.3-1.ph4, 20.12.1-1.ph5

nodejs-docs

1:16.20.2-8.0.1.el9_4, 1:18.18.2-1.amzn2023.0.4, 1:18.20.2-1.module+el8.9.0+90319+0b1e7189, 1:18.20.2-1.module+el9.4.0+90321+c72a88c5, 1:20.12.2-2.module+el8.9.0+90318+7fb2e04b, 1:20.12.2-2.module+el9.4.0+90322+0b80090c

nodejs-full-i18n

1:16.20.2-8.0.1.el9_4, 1:18.18.2-1.amzn2023.0.4, 1:18.20.2-1.module+el8.9.0+90319+0b1e7189, 1:18.20.2-1.module+el9.4.0+90321+c72a88c5, 1:20.12.2-2.module+el8.9.0+90318+7fb2e04b, 1:20.12.2-2.module+el9.4.0+90322+0b80090c

nodejs-libs

1:16.20.2-8.0.1.el9_4, 1:18.18.2-1.amzn2023.0.4

nodejs-nodemon

3.0.1-1.module_el8.8.0+3613+1ed8c91d, 3.0.1-1.module_el8.9.0+3731+490e3ce5, 3.0.1-1.module_el9.2.0+36+853e48f5, 3.0.1-1.module_el9.3.0+47+c33bc288, 3.0.1-1.module+el8.8.0+1459+02651ab6, 3.0.1-1.module+el8.9.0+90082+b6a613a6, 3.0.1-1.module+el8.9.0+90157+ed89dc20, 3.0.1-1.module+el9.3.0+90066+12d4a8d7, 3.0.1-1.module+el9.3.0+90167+01064547, 3.0.1-1.module+el9.6.0+32494+726e9034

nodejs-npm

1:9.8.1-1.18.18.2.1.amzn2023.0.4

nodejs-packaging

2021.06-4.module_el8.7.0+3343+ea2b7901, 2021.06-4.module_el8.9.0+3684+11b9e959, 2021.06-4.module_el9.1.0+13+d9a595ea, 2021.06-4.module_el9.3.0+88+29afeaa2, 2021.06-4.module+el8.7.0+1072+5b168780, 2021.06-4.module+el8.9.0+90082+b6a613a6, 2021.06-4.module+el8.9.0+90157+ed89dc20, 2021.06-4.module+el9.1.0+20762+f52d7401, 2021.06-4.module+el9.3.0+90066+12d4a8d7, 2021.06-4.module+el9.6.0+32494+726e9034

nodejs-packaging-bundler

2021.06-4.module+el8.9.0+90082+b6a613a6, 2021.06-4.module+el8.9.0+90157+ed89dc20, 2021.06-4.module+el9.1.0+20762+f52d7401, 2021.06-4.module+el9.3.0+90066+12d4a8d7

nodejs:16

8080020240510090838.63b34585

nodejs:18

9040020240422140329.rhel9

nodejs:20

8090020240422150739.a75119d5

nodejs12

12.22.12-150200.4.59.1

nodejs12-devel

12.22.12-150200.4.59.1

nodejs12-docs

12.22.12-150200.4.59.1

nodejs14

14.21.3-150200.15.58.1

nodejs14-devel

14.21.3-150200.15.58.1

nodejs14-docs

14.21.3-150200.15.58.1

nodejs16

16.20.2-150300.7.36.2, 16.20.2-150400.3.33.1, 16.20.2-8.42.1

Timeline

  1. Publicly disclosed

    Apr 9, 2024

  2. Last updated

    Aug 27, 2026

Weakness Type

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
  • CWE-400 Uncontrolled Resource Consumption

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2024-27983 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo