Listen to this Post
How the CVE Works:
CVE-2021-22931 is a critical remote code execution vulnerability in Node.js due to improper input validation in the `http2` module. An attacker can exploit this flaw by sending a specially crafted HTTP/2 request, triggering an uncaught exception that leads to a denial of service (DoS) or arbitrary code execution. The issue arises when malicious header fields are processed, causing an out-of-bounds read or memory corruption. This vulnerability affects Node.js versions 12.x, 14.x, and 16.x before patches were applied.
DailyCVE Form:
Platform: Node.js
Version: 12.x, 14.x, 16.x
Vulnerability: HTTP/2 RCE
Severity: Critical
Date: 2021-09-07
Prediction: Patch expected by 2021-09-14
What Undercode Say:
node -v Check Node.js version npm update -g Update Node.js curl -I --http2 <target> Test HTTP/2 exposure
How Exploit:
- Send crafted HTTP/2 headers
- Trigger uncaught exception
- Execute arbitrary code via memory corruption
Protection from this CVE:
- Upgrade to Node.js 12.22.7, 14.18.0, or 16.9.0
- Disable HTTP/2 if unused
- Apply input validation filters
Impact:
- Remote code execution
- Denial of service (DoS)
- Server compromise
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
