CVE-2024-27983
Node.js 18 and 2 others: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-27983 is fixed in 27 products on 2 platforms, first by Node.js 18 18.20.1, released April 2, 2024. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 2 platforms
CVSS
8.2
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.8721
99th percentile
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 18 | 18.20.1 | Node.js 18 18.20.1 | Apr 2, 2024 |
| Node.js 20 | 20.12.1 | Node.js 20 20.12.1 | Apr 3, 2024 |
| Node.js 21 | 21.7.2 | Node.js 21 21.7.2 | Apr 3, 2024 |
| Linux | |||
| nodejs · Debian 12.15 (bookworm) | 18.20.4+dfsg-1~deb12u1 | DEBIAN-CVE-2024-27983 | Apr 9, 2024 |
| nodejs · Debian 13.5 (trixie) | 18.20.1+dfsg-1 | DEBIAN-CVE-2024-27983 | Apr 9, 2024 |
| nodejs · Debian 14 | 18.20.1+dfsg-1 | DEBIAN-CVE-2024-27983 | Apr 9, 2024 |
| nodejs · RHEL 8 | 1:18.20.2-1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780 | May 9, 2024 |
| nodejs · RHEL 9 | 1:16.20.2-8.el9_4 | RHSA-2024:2910 | May 20, 2024 |
| nodejs · almalinux 8 | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 | May 9, 2024 |
| nodejs · almalinux 9 | 1:16.20.2-8.el9_4 | ALSA-2024:2910 | May 20, 2024 |
| nodejs · amzn 2023 | 1:18.18.2-1.amzn2023.0.4 | ALAS2023-2024-593 | Apr 25, 2024 |
| nodejs · ol 8 | 1:18.20.2-1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780 | May 10, 2024 |
| nodejs · ol 9 | 1:18.20.2-1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2779 | May 14, 2024 |
| nodejs · rocky 8 | 1:18.20.2-1.module+el8.9.0+1803+9ac8b495 | RLSA-2024:2780 | May 9, 2024 |
| nodejs · rocky 9 | 1:16.20.2-8.el9_4 | RLSA-2024:2910 | Jun 14, 2024 |
| nodejs-debuginfo · amzn 2023 | 1:18.18.2-1.amzn2023.0.4 | ALAS2023-2024-593 | Apr 25, 2024 |
| nodejs-debugsource · amzn 2023 | 1:18.18.2-1.amzn2023.0.4 | ALAS2023-2024-593 | Apr 25, 2024 |
| nodejs-devel · RHEL 8 | 1:18.20.2-1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780 | May 9, 2024 |
| nodejs-devel · RHEL 9 | 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 | RHSA-2024:2853 | May 15, 2024 |
| nodejs-devel · almalinux 8 | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 | May 9, 2024 |
| nodejs-devel · almalinux 9 | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 | May 15, 2024 |
| nodejs-devel · amzn 2023 | 1:18.18.2-1.amzn2023.0.4 | ALAS2023-2024-593 | Apr 25, 2024 |
| nodejs-devel · ol 8 | 1:18.20.2-1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-devel · ol 9 | 1:18.20.2-1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2779 | May 14, 2024 |
| nodejs-docs · RHEL 8 | 1:18.20.2-1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780 | May 9, 2024 |
| nodejs-docs · RHEL 9 | 1:16.20.2-8.el9_4 | RHSA-2024:2910 | May 20, 2024 |
| nodejs-docs · almalinux 8 | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 | May 9, 2024 |
| nodejs-docs · almalinux 9 | 1:16.20.2-8.el9_4 | ALSA-2024:2910 | May 20, 2024 |
| nodejs-docs · amzn 2023 | 1:18.18.2-1.amzn2023.0.4 | ALAS2023-2024-593 | Apr 25, 2024 |
| nodejs-docs · ol 8 | 1:18.20.2-1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-docs · ol 9 | 1:18.20.2-1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2779 | May 14, 2024 |
| nodejs-full-i18n · RHEL 8 | 1:18.20.2-1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780 | May 9, 2024 |
| nodejs-full-i18n · RHEL 9 | 1:16.20.2-8.el9_4 | RHSA-2024:2910 | May 20, 2024 |
| nodejs-full-i18n · almalinux 8 | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 | May 9, 2024 |
| nodejs-full-i18n · almalinux 9 | 1:16.20.2-8.el9_4 | ALSA-2024:2910 | May 20, 2024 |
| nodejs-full-i18n · amzn 2023 | 1:18.18.2-1.amzn2023.0.4 | ALAS2023-2024-593 | Apr 25, 2024 |
| nodejs-full-i18n · ol 8 | 1:18.20.2-1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-full-i18n · ol 9 | 1:18.20.2-1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2779 | May 14, 2024 |
| nodejs-libs · RHEL 9 | 1:16.20.2-8.el9_4 | RHSA-2024:2910 | May 20, 2024 |
| nodejs-libs · almalinux 9 | 1:16.20.2-8.el9_4 | ALSA-2024:2910 | May 20, 2024 |
| nodejs-libs · amzn 2023 | 1:18.18.2-1.amzn2023.0.4 | ALAS2023-2024-593 | Apr 25, 2024 |
| nodejs-libs · ol 9 | 1:16.20.2-8.0.1.el9_4 | ELSA-2024-2910 | May 22, 2024 |
| nodejs-libs-debuginfo · amzn 2023 | 1:18.18.2-1.amzn2023.0.4 | ALAS2023-2024-593 | Apr 25, 2024 |
| nodejs-nodemon · RHEL 8 | 0:3.0.1-1.module+el8.9.0+21190+5ebd2c33 | RHSA-2024:2780 | May 9, 2024 |
| nodejs-nodemon · RHEL 9 | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 | RHSA-2024:2853 | May 15, 2024 |
| nodejs-nodemon · almalinux 8 | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2024:2780 | May 9, 2024 |
| nodejs-nodemon · almalinux 9 | 3.0.1-1.module_el9.3.0+47+c33bc288 | ALSA-2024:2853 | May 15, 2024 |
| nodejs-nodemon · ol 8 | 0:3.0.1-1.module+el8.9.0+90157+ed89dc20 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-nodemon · ol 9 | 0:3.0.1-1.module+el9.3.0+90167+01064547 | ELSA-2024-2779 | May 14, 2024 |
| nodejs-nodemon · rocky 8 | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2780 | May 9, 2024 |
| nodejs-nodemon · rocky 9 | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 | Jun 14, 2024 |
| nodejs-npm · amzn 2023 | 1:9.8.1-1.18.18.2.1.amzn2023.0.4 | ALAS2023-2024-593 | Apr 25, 2024 |
| nodejs-packaging · RHEL 8 | 0:2021.06-4.module+el8.9.0+21190+5ebd2c33 | RHSA-2024:2780 | May 9, 2024 |
| nodejs-packaging · RHEL 9 | 0:2021.06-4.module+el9.3.0+19518+63aad52d | RHSA-2024:2853 | May 15, 2024 |
| nodejs-packaging · almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 | May 9, 2024 |
| nodejs-packaging · almalinux 9 | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 | May 15, 2024 |
| nodejs-packaging · ol 8 | 0:2021.06-4.module+el8.9.0+90157+ed89dc20 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-packaging · ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | ELSA-2024-2779 | May 14, 2024 |
| nodejs-packaging · rocky 8 | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2780 | May 9, 2024 |
| nodejs-packaging · rocky 9 | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 | Jun 14, 2024 |
| nodejs-packaging-bundler · RHEL 8 | 0:2021.06-4.module+el8.9.0+21190+5ebd2c33 | RHSA-2024:2780 | May 9, 2024 |
| nodejs-packaging-bundler · RHEL 9 | 0:2021.06-4.module+el9.3.0+19518+63aad52d | RHSA-2024:2853 | May 15, 2024 |
| nodejs-packaging-bundler · almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 | May 9, 2024 |
| nodejs-packaging-bundler · almalinux 9 | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 | May 15, 2024 |
| nodejs-packaging-bundler · ol 8 | 0:2021.06-4.module+el8.9.0+90157+ed89dc20 | ELSA-2024-2780 | May 10, 2024 |
| nodejs-packaging-bundler · ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | ELSA-2024-2779 | May 14, 2024 |
| nodejs20 · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-debuginfo · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-debugsource · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-devel · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-docs · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-full-i18n · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-libs · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-libs-debuginfo · amzn 2023 | 1:20.12.2-1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| nodejs20-npm · amzn 2023 | 1:10.5.0-1.20.12.2.1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
| npm · RHEL 8 | 1:10.5.0-1.18.20.2.1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780 | May 9, 2024 |
| npm · RHEL 9 | 1:8.19.4-1.16.20.2.8.el9_4 | RHSA-2024:2910 | May 20, 2024 |
| npm · almalinux 8 | 1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 | May 9, 2024 |
| npm · almalinux 9 | 1:8.19.4-1.16.20.2.8.el9_4 | ALSA-2024:2910 | May 20, 2024 |
| npm · ol 8 | 1:10.5.0-1.18.20.2.1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780 | May 10, 2024 |
| npm · ol 9 | 1:10.5.0-1.18.20.2.1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2779 | May 14, 2024 |
| v8-10.2-devel · amzn 2023 | 3:10.2.154.26-1.18.18.2.1.amzn2023.0.4 | ALAS2023-2024-593 | Apr 25, 2024 |
| v8-11.3-devel · amzn 2023 | 3:11.3.244.8-1.20.12.2.1.amzn2023.0.2 | ALAS2023-2024-594 | Apr 25, 2024 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.