Node.js fixes severe HTTP bug that could let attackers crash apps

guest · Jul 31, 2021

Node.js fixes severe HTTP bug that could let attackers crash apps
July 30, 2021
https://www.bleepingcomputer.com/ne...http-bug-that-could-let-attackers-crash-apps/

Node.js has released updates for a high severity vulnerability that could be exploited by attackers to corrupt the process and cause unexpected behaviors, such as application crashes and potentially remote code execution (RCE).

The use-after-free vulnerability, tracked as CVE-2021-22930 is to do with how HTTP2 streams are handled in the language.
Click to expand...

The fixes landed in the latest Node.js release 16.6.0 and were also backported to versions 12.22.4 (LTS) and 14.17.4 (LTS).

This error—previously thought of as a "bug" rather than an exploitable vulnerability, was reported on June 8th, 2021 by Matthew Douglass on a public thread.
Douglass was able to reproduce the bug 100% of the time on his system, resulting in application crashes.

"The issue seems to be because of the handling of the RST_STREAM frame received with no error code and cancel error code."
Click to expand...

Log in or Sign up

Node.js fixes severe HTTP bug that could let attackers crash apps

guest Guest

Log in or Sign up

Node.js fixes severe HTTP bug that could let attackers crash apps

guest Guest

Useful Searches