CVE-2019-9512: HTTP/2 Ping Flood Denial of Service in nodejs

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications. The HTTP/2 protocol is supported by Node.js and provides improved performance and efficiency. However, some implementations of HTTP/2 in Node.js are vulnerable to ping floods, which can lead to a denial of service (DoS) attack. An attacker can continuously send pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. This can consume excessive CPU and memory resources, potentially disrupting the normal functioning of the system.

Vulnerability Detail

The vulnerability, known as CVE-2019-9512, arises due to inefficient queuing of ping responses in HTTP/2 implementations. When an attacker sends a large number of pings, the target peer accumulates these requests in its internal queue. Depending on the efficiency of the queuing mechanism, this can result in high CPU and memory usage. As a consequence, the system may become unresponsive or experience performance degradation. The severity of this vulnerability is rated as 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

sudo apk add --upgrade nodejs

Workaround

As a workaround, if updating the Node.js package is not immediately feasible, it is possible to disable HTTP/2 support in the affected application. By disabling HTTP/2, the system will not be vulnerable to ping floods. However, this workaround may impact the performance and efficiency benefits provided by the HTTP/2 protocol. Here is an example of how to disable HTTP/2 in Node.js:

const http2 = require('http2');

const server = http2.createServer();

// Disable HTTP/2 support
server.on('stream', (stream, headers) => {
  stream.respond({
    ':status': 200,
    'content-type': 'text/plain'
  });
  stream.end('Hello World');
});

Conclusion

CVE-2019-9512 is a vulnerability in Node.js that affects the HTTP/2 implementation. It allows an attacker to perform a ping flood attack, potentially leading to a denial of service. To mitigate this vulnerability, it is recommended to update the affected Node.js package to version 10.16.3-r0 or later. Alternatively, HTTP/2 support can be temporarily disabled. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for nodejs →

FAQ