/CVE-2024-27983-nodejs-http2

CVE-2024-27983 this repository builds up a vulnerable HTTP2 Node.js server (`server-nossl.js`) based on CVE-2024-27983 which exploits a continuation flood vulnerability in HTTP2 servers.

Primary LanguageGoOtherNOASSERTION

This repository builds up a vulnerable HTTP2 Node.js server (server-nossl.js) based on CVE-2024-27983 which exploits a continuation flood vulnerability in HTTP2 servers.

Notes:

  • server.js is found not vulnerable due to the use of SSL certificates.
  • server-nossl.js is vulnerable to the continuation flood attack.
  • client.js is a small client script to test the HTTP2 server.
  • exploits/ contains the exploit code for the vulnerability based on the HackerOne report.