{"id":"VND-nodejs-april-2024-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2024-27982","CVE-2024-27983"],"title":"Node.js: Wednesday, April 3, 2024 Security Releases","description":"Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners Wednesday, April 3, 2024 Security Releases TNJP The Node.js Project Wednesday, April 3, 2024 Security Releases Security releases available\nUpdates are now available for the v18.x, v20.x and 21.x Node.js release lines for the\nfollowing issues.\nThis security release includes the following dependency updates to address public vulnerabilities:\nllhttp version 9.2.1 on 21.x, 20.x, and 18.x\nundici version 6.11.1 on 21.x\nundici version 5.28.4 on 18.x and 20.x\nAssertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash (CVE-2024-27983) - (High)\nAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.\nImpacts:\nThis vulnerability affects all users in all active release lines: 18.x, 20.x and, 21.x.\nThank you, to bart for reporting this vulnerability and Anna Henningsen for fixing it.\nHTTP Request Smuggling via Content Length Obfuscation - (CVE-2024-27982) - (Medium)\nThe team has identified a vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.\nImpacts:\nThis vulnerability affects all users in all active release lines: 18.x, 20.x and, 21.x.\nThank you, to bpingel for reporting this vulnerability and Paolo Insogna for fixing it.\nSummary\nThe Node.js project will release new versions of the 18.x, 20.x, 21.x\nreleases lines on or shortly after, Wednesday, April 3, 2024 in order to address:\n1 medium severity issue.\n1 high severity issue.\nImpact\nThe 18.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.\nThe 20.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.\nThe 21.x release line of Node.js is vulnerable to 1 medium severity issue, 1 high severity issue.\nRelease timing\nReleases will be available on, or shortly after, Wednesday, April 3, 2024.\nContact and future updates\nThe current Node.js security policy can be found at https://nodejs.org/en/security/ . Please follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous Wednesday, April 10, 2024 Security Releases Next Wednesday February 14 2024 Security Releases","summary":"Node.js 18.x, 20.x and 21.x have two flaws: a race condition in the HTTP/2 server that can crash it (CVE-2024-27983), and a malformed content-length header that lets a request smuggle a second request (CVE-2024-27982). An attacker can take the HTTP/2 server offline or sneak requests past proxies that front the Node.js HTTP server.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":[],"affected":"","ecosystem":"node"},{"name":"node","fixed":[],"affected":"18.x","ecosystem":"node"},{"name":"node","fixed":[],"affected":"20.x","ecosystem":"node"},{"name":"node","fixed":[],"affected":"21.x","ecosystem":"node"}],"ecosystems":["node"],"tags":["http-server","node","node.js","runtime","self-hosted"],"not_affected_if":["unpatched-lines-not-used"],"how_to_check":"- Run `node --version` and compare against the fixed releases listed in the fix section.\n- Check whether the app serves HTTP/2 with `http2.createServer` or `http2.createSecureServer`.\n- Check whether a proxy or load balancer sits in front of Node.js and forwards requests to it.","fix":"- Upgrade Node.js 18.x, 20.x and 21.x to the patched releases published on or shortly after April 3, 2024 (exact version numbers unknown from sources).\n- Upgrade bundled dependencies: llhttp `9.2.1`, undici `6.11.1` on 21.x, undici `5.28.4` on 18.x and 20.x.","status":"open","published_at":"2024-04-03T03:00:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:39:36+00:00","updated_at":"2026-10-25T05:39:36+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:39:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js 18.x, 20.x and 21.x to the patched releases published on or shortly after April 3, 2024 (exact version numbers unknown from sources).\n- Upgrade bundled dependencies: llhttp `9.2.1`, undici `6.11.1` on 21.x, undici `5.28.4` on 18.x and 20.x.","reach":"internet","title":"Node.js: HTTP/2 server crash and HTTP request smuggling in April 2024 releases","impact":"medium","summary":"Node.js 18.x, 20.x and 21.x have two flaws: a race condition in the HTTP/2 server that can crash it (CVE-2024-27983), and a malformed content-length header that lets a request smuggle a second request (CVE-2024-27982). An attacker can take the HTTP/2 server offline or sneak requests past proxies that front the Node.js HTTP server.","category":"runtime","nicknames":[],"who_cares":["node.js","self-hosted","http-server"],"confidence":0.6,"needs_auth":"no","worst_case":"Server crashes or requests are smuggled past a proxy","analyst_note":"Fetch https://nodejs.org/en/blog/vulnerability/april-2024-security-releases to get exact patched version numbers per release line.","how_to_check":"- Run `node --version` and compare against the fixed releases listed in the fix section.\n- Check whether the app serves HTTP/2 with `http2.createServer` or `http2.createSecureServer`.\n- Check whether a proxy or load balancer sits in front of Node.js and forwards requests to it.","needs_analyst":true,"not_affected_if":["unpatched-lines-not-used"],"who_is_affected":"All users of the 18.x, 20.x and 21.x release lines are affected, per the advisory. The HTTP/2 crash needs an HTTP/2 server exposed to clients, and the smuggling flaw matters most where a proxy and a Node.js backend parse requests differently. Teams running only end-of-life Node.js versions should upgrade to a supported line instead of relying on this patch.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000824,"input_tokens":4451,"output_tokens":758,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2024':52B,70B,197C,318C '-27982':71B,319C '-27983':53B,198C '/en/security/':532C '/forum/#!forum/nodejs-sec':568C '/nodejs/node/blob/master/security.md':541C '1':440C,444C,459C,463C,477C,481C,495C,499C '10':596C '14':603C '18':30B,167C,179C,289C,389C,420C,450C '20':32B,164C,182C,291C,391C,422C,468C '2024':5A,12A,112C,122C,435C,516C,597C,604C '21':35B,137C,162C,173C,294C,394C,424C,486C '3':4A,111C,121C,434C,515C '5.28.4':177C '6.11.1':171C '9.2.1':160C 'abrupt':254C 'activ':286C,386C 'address':155C,439C 'affect':281C,381C 'amount':214C 'anna':305C 'announc':558C 'announcement-on':557C 'april':3A,11A,110C,120C,433C,514C,595C 'assert':184C 'attack':73B,201C,365C 'avail':101C,127C,131C,508C 'bart':299C 'bodi':374C 'bpingel':399C 'caus':274C 'client':258C 'close':255C 'commerci':91C 'complet':208C 'condit':42B,277C 'connect':252C 'contact':517C 'content':58B,314C,356C 'content-length':57B,355C 'continu':241C 'correct':363C 'crash':49B,195C 'current':522C 'cve':51B,69B,196C,317C 'data':231C 'date':573C 'depend':152C 'destructor':262C 'ecosystem':105C 'enabl':364C 'fail':185C 'februari':602C 'first':377C 'fix':308C,408C 'flaw':39B 'follow':144C,151C,534C 'found':528C 'frame':217C,223C,242C,265C 'front':86B 'futur':519C 'github':591C 'github.com':540C 'github.com/nodejs/node/blob/master/security.md':539C 'groups.google.com':567C 'groups.google.com/forum/#!forum/nodejs-sec':566C 'header':60B,238C,264C,340C,358C 'henningsen':306C 'high':199C,445C,464C,482C,500C 'host':28B 'http':21B,89B,310C,329C,344C 'http-server':20B 'http/2':45B,77B,193C,206C,216C,222C,240C 'http2':188C 'http2session':189C,190C,261C 'identifi':324C 'impact':278C,378C,448C 'includ':149C 'insid':224C 'insogna':406C 'interpret':362C 'issu':145C,443C,447C,462C,466C,480C,484C,498C,502C 'lead':191C,342C 'leav':229C 'length':59B,315C,357C 'let':62B 'line':141C,288C,388C,427C,453C,471C,489C 'list':564C 'llhttp':158C 'low':555C 'low-volum':554C 'lts':98C 'mail':563C 'maintain':587C 'mainten':97C 'make':203C 'malform':56B,339C 'medium':320C,441C,460C,478C,496C 'memori':234C,273C 'new':416C 'next':600C 'nghttp2':233C 'node':16A,17A,18A,19A,23B,187C,337C 'node.js':1A,24B,29B,88B,117C,139C,205C,412C,455C,473C,491C,523C,550C,583C 'nodej':561C,590C 'nodejs':10A 'nodejs-sec':560C 'nodejs.org':531C 'nodejs.org/en/security/':530C 'obfusc':316C 'offlin':79B 'openj':104C 'order':437C 'organ':592C 'outlin':537C 'packet':218C 'paolo':405C 'partner':108C 'past':83B,95C 'phase':99C 'place':352C 'pleas':533C 'polici':525C 'possibl':227C 'previous':593C 'process':269C,536C 'program':107C 'project':118C,413C,586C 'proxi':84B 'public':156C 'race':41B,276C 'recent':334C 'relat':580C 'releas':7A,114C,124C,126C,140C,148C,287C,387C,415C,426C,452C,470C,488C,503C,505C,581C,599C,606C 'releases':15A 'report':301C,401C,546C 'request':64B,68B,82B,311C,345C,371C 'reset':236C 'runtim':25B 'sec':562C 'second':67B,370C 'secur':6A,113C,123C,125C,147C,524C,575C,579C,598C,605C 'security':14A 'security-rel':578C 'security-releases':13A 'self':27B 'self-host':26B 'send':211C 'sent':244C 'server':22B,46B,78B,90B,194C,207C,247C,330C 'sever':442C,446C,461C,465C,479C,483C,497C,501C 'short':430C,511C 'small':213C 'smuggl':65B,312C,346C,367C 'sneak':81B 'space':350C 'specif':347C 'stay':570C 'still':267C 'store':271C 'subscrib':551C 'summari':410C 'support':92C 'sustain':106C 'take':75B 'tcp':251C 'team':322C 'thank':296C,396C 'time':504C 'tnjp':115C 'trigger':259C 'two':38B 'unavail':209C 'undici':169C,175C 'updat':128C,153C,520C 'user':283C,383C 'v18.x':134C 'v20.x':135C 'version':94C,159C,170C,176C,335C,417C 'via':313C 'vnd':9A 'vnd-nodejs-april':8A 'volum':556C 'vulner':157C,280C,303C,326C,380C,403C,457C,475C,493C,548C,576C 'wednesday':2A,109C,119C,432C,513C,594C,601C 'wish':544C 'within':372C 'x':31B,33B,36B,138C,163C,165C,168C,174C,180C,183C,290C,292C,295C,390C,392C,395C,421C,423C,425C,451C,469C,487C","nicknames":[],"mitigations":[],"who_affected":"All users of the 18.x, 20.x and 21.x release lines are affected, per the advisory. The HTTP/2 crash needs an HTTP/2 server exposed to clients, and the smuggling flaw matters most where a proxy and a Node.js backend parse requests differently. Teams running only end-of-life Node.js versions should upgrade to a supported line instead of relying on this patch.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-03T03:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"april-2024-security-releases","url":"https://nodejs.org/en/blog/vulnerability/april-2024-security-releases","severity":"high","published_at":"2024-04-03T03:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T21:27:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}