ALTSVC Frame Handling Vulnerability in nghttp2
Summary
CVE-2018-1000168: nghttp2 version >= 1.10.0 and nghttp2. Affects nodejs across 2 version ranges.
< 8.11.3-r0
>= cf41627411886000429bde058a6594fb7f6d6d47, < 1442cfef73c0a7157b1552658529ae9ff9154de9
Fixed in 8.11.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nghttp2 is a library for HTTP/2 protocol implementation. It provides an API for building HTTP/2 clients and servers. The ALTSVC frame is used to advertise alternative services available on a server. However, nghttp2 versions between 1.10.0 and 1.31.0 contain a vulnerability in the ALTSVC frame handling. This vulnerability allows an attacker to trigger a segmentation fault, leading to a denial of service. The vulnerability can be exploited by a network client.
Vulnerability Detail
The ALTSVC frame handling vulnerability in nghttp2 can be exploited by an attacker to cause a segmentation fault, resulting in a denial of service. By sending a specially crafted ALTSVC frame, an attacker can trigger the vulnerability and crash the nghttp2 server. This can lead to service disruption and impact the availability of the affected system. The vulnerability has been assigned the CVE identifier CVE-2018-1000168 and has a CVSS score of 7.5.
How To Fix
Minimum fixed version
8.11.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update nghttp2 to the fixed version as soon as possible.
Conclusion
The ALTSVC frame handling vulnerability in nghttp2 can be exploited by an attacker to cause a denial of service. It is recommended to update nghttp2 to version 1.31.1 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
nghttp2 is a library for HTTP/2 protocol implementation, providing an API for building HTTP/2 clients and servers.
The ALTSVC frame is used to advertise alternative services available on a server.
The vulnerability allows an attacker to trigger a segmentation fault, leading to a denial of service. This can result in service disruption and impact the availability of the affected system.
The vulnerability can be exploited by sending a specially crafted ALTSVC frame to the nghttp2 server.
The CVSS score of this vulnerability is 7.5.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
