Rule Definition
All versions before Node.js 6.14.13, 8.11.3, 9.11.2 and 10.4.1: All versions of 8.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This rule has been listed as CVE-2018-7161 in the CVE registry. All versions before Node.js 6.14.3, 9.11.2 and 10.4.1, from 8.4.0 to 8.11.2: All versions of 9.x and later are vulnerable and the severity is HIGH. Under certain conditions, a malicious client can trigger an uninitialized read (and a subsequent segfault) by sending a malformed ALTSVC frame. This has been addressed through an by updating nghttp2.. This rule has been listed as CVE-2018-1000168 in the CVE registry. Overall all the versions before Node.js 6.14.3,8.11.3, 9.11.2 and 10.4.1 are vulnerable.

Remediation
Update the Node.js library to have a fixed HTTP/2 implementation

Violation Code Sample

import * as http from 'http2'

const server = http2.createServer();

All versions before Node.js 8.11.3, 9.11.2 and 10.4.1 : https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7161 All versions before Node.js 6.14.3, 9.11.2 and 10.4.1, from 8.4.0 to 8.11.2: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000168