Denial of Service Vulnerability in Nginx and Node.js due to HTTP/2 Header Leak
Summary
ALPINE-CVE-2019-9516: Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. Affects nginx versions < 1.16.1-r0. Fixed in 1.16.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nginx is a high-performance web server and reverse proxy server known for its stability, rich feature set, and low resource consumption. Node.js is a JavaScript runtime built on Chrome's V8 engine, designed for building scalable network applications. Both packages are widely used in web development and server management. The vulnerability in question affects the HTTP/2 implementation in these packages, allowing attackers to exploit header leaks, which can lead to denial of service.
Vulnerability Detail
The vulnerability arises from certain HTTP/2 implementations that are susceptible to a header leak. An attacker can send a continuous stream of headers with both the header name and value set to zero length, potentially encoded using Huffman encoding. This can lead to excessive memory allocation that persists until the session is terminated, resulting in a denial of service as the server may exhaust its memory resources.
How To Fix
Minimum fixed version
1.16.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nginxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the maximum header size in your server configuration to mitigate the impact of this vulnerability. For Nginx, you can add the following line to your configuration file:
http {
http2_max_field_size 4k;
http2_max_header_size 8k;
}
Conclusion
This report outlines a significant denial of service vulnerability affecting Nginx and Node.js due to a header leak in HTTP/2 implementations. It is crucial to update to the patched versions of these packages to mitigate the risk. Additionally, temporary workarounds can be employed until updates can be applied.
See every vulnerability recorded for nginx →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to denial of service, causing the server to become unresponsive due to excessive memory consumption.
Yes, the permanent fix is to update the affected packages to their patched versions as specified in the 'how_to_fix' section.
If immediate updates are not possible, consider implementing the suggested workaround to limit header sizes and reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
