Node.js patches HTTP/2 DoS, cookie leak vulnerabilities

Summary

HTTP/2 servers in production are exposed to denial-of-service via stream cancellation without bounds. Cookie leakage through redirect chains breaks assumed browser security boundaries in fetch implementations.

Why it matters

HTTP/2 servers in production are exposed to denial-of-service via stream cancellation without bounds. Cookie leakage through redirect chains breaks assumed browser security boundaries in fetch implementations.

Sources

1. 1.Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound causes denial of service.
2. 2.Undici did not always clear Cookie headers on cross-origin redirects.
3. 3.This vulnerability affects all users of HTTP/2 servers in all active release lines 18.x and 20.x.
4. 4.Releases will be available on, or shortly after, Friday October 13 2023.