CVE catalog

CVE-2020-11080

nodejs: CVE-2020-11080

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Jun 2, 2020, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 5.32% · Oct 25, 2026

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	nodejs	sid	`24.22.1+dfsg+~cs24.19.2-1`	fixed
Debian	nodejs	forky	`24.21.0+dfsg+~cs24.13.4-1`	fixed
Debian	nodejs	trixie	`20.19.2+dfsg-1+deb13u2`	fixed
Debian	nodejs	trixie-security	`20.19.2+dfsg-1+deb13u3`	fixed
Debian	nodejs	bookworm	`18.20.4+dfsg-1~deb12u2`	fixed
Debian	nodejs	bookworm-security	`18.20.4+dfsg-1~deb12u3`	fixed
Debian	nghttp2	sid	`1.70.0-1`	fixed
Debian	nghttp2	forky	`1.70.0-1`	fixed
Debian	nghttp2	trixie	`1.64.0-1.1+deb13u1`	fixed
Debian	nghttp2	trixie-security	`1.64.0-1.1+deb13u1`	fixed
Debian	nghttp2	bookworm	`1.52.0-1+deb12u3`	fixed
Debian	nghttp2	bookworm-security	`1.52.0-1+deb12u3`	fixed
Alpine	nghttp2	3.10	`1.39.2-r1`	fixed
Alpine	nghttp2	3.11	`1.40.0-r1`	fixed
Alpine	nghttp2	3.12	`1.41.0-r0`	fixed
Alpine	nghttp2	3.13	`1.41.0-r0`	fixed
Alpine	nghttp2	3.14	`1.41.0-r0`	fixed
Alpine	nghttp2	3.15	`1.41.0-r0`	fixed
Alpine	nghttp2	3.16	`1.41.0-r0`	fixed
Alpine	nghttp2	3.17	`1.41.0-r0`	fixed
Alpine	nghttp2	3.18	`1.41.0-r0`	fixed
Alpine	nghttp2	3.19	`1.41.0-r0`	fixed
Alpine	nghttp2	3.20	`1.41.0-r0`	fixed
Alpine	nghttp2	3.21	`1.41.0-r0`	fixed
Alpine	nghttp2	3.22	`1.41.0-r0`	fixed
Alpine	nghttp2	3.23	`1.41.0-r0`	fixed
Alpine	nghttp2	3.24	`1.41.0-r0`	fixed
Alpine	nghttp2	3.9	`1.35.1-r2`	fixed
Alpine	nodejs	3.11	`12.20.1-r0`	fixed
Alpine	nodejs	3.12	`12.18.3-r0`	fixed
Alpine	nodejs	3.13	`12.18.0-r0`	fixed
Alpine	nodejs	3.14	`12.18.0-r0`	fixed
Alpine	nodejs	3.15	`12.18.0-r0`	fixed
Alpine	nodejs	3.16	`12.18.0-r0`	fixed
Alpine	nodejs	3.17	`12.18.0-r0`	fixed
Alpine	nodejs	3.18	`12.18.0-r0`	fixed
Alpine	nodejs	3.19	`12.18.0-r0`	fixed
Alpine	nodejs	3.20	`12.18.0-r0`	fixed
Alpine	nodejs	3.21	`12.18.0-r0`	fixed
Alpine	nodejs	3.22	`12.18.0-r0`	fixed
Alpine	nodejs	3.23	`12.18.0-r0`	fixed
Alpine	nodejs	3.24	`12.18.0-r0`	fixed
Ubuntu	nghttp2	pro	`1.25.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.27.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.28.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.29.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.29.0-1build1`	vulnerable
Ubuntu	nghttp2	pro	`1.30.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.30.0-1ubuntu1`	vulnerable
Ubuntu	nghttp2	pro	`1.30.0-1ubuntu1+esm1`	fixed
Ubuntu	nghttp2	20.04	`1.39.2-1`	vulnerable
Ubuntu	nghttp2	20.04	`1.40.0-1`	vulnerable
Ubuntu	nghttp2	20.04	`1.40.0-1build1`	vulnerable
Ubuntu	nghttp2	20.04	`1.40.0-1ubuntu0.1`	fixed
Ubuntu	nghttp2	pro	`1.25.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.27.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.28.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.29.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.29.0-1build1`	vulnerable
Ubuntu	nghttp2	pro	`1.30.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.30.0-1ubuntu1`	vulnerable
Ubuntu	nghttp2	pro	`1.30.0-1ubuntu1+esm1`	fixed
Ubuntu	nghttp2	20.04	`1.39.2-1`	vulnerable
Ubuntu	nghttp2	20.04	`1.40.0-1`	vulnerable
Ubuntu	nghttp2	20.04	`1.40.0-1build1`	vulnerable
Ubuntu	nghttp2	20.04	`1.40.0-1ubuntu0.1`	fixed
Opensuse	nodejs8	leap 15.1	`8.17.0-lp151.2.15.1`	fixed
Suse	nodejs8	linux enterprise module for web and scripting 15 sp1	`8.17.0-3.32.1`	fixed
Suse	nodejs8	linux enterprise high performance computing 15-espos	`8.17.0-3.32.1`	fixed
Suse	nodejs8	linux enterprise high performance computing 15-ltss	`8.17.0-3.32.1`	fixed
Suse	nodejs8	linux enterprise server 15-ltss	`8.17.0-3.32.1`	fixed
Suse	nodejs8	linux enterprise server for sap applications 15	`8.17.0-3.32.1`	fixed
Suse	nodejs12	linux enterprise module for web and scripting 12	`12.18.0-1.14.1`	fixed
Opensuse	nghttp2	leap 15.2	`1.40.0-lp152.2.6.1`	fixed
Opensuse	nghttp2-python	leap 15.2	`1.40.0-lp152.2.6.1`	fixed
Suse	nghttp2	linux enterprise high performance computing 15-espos	`1.40.0-3.11.1`	fixed
Suse	nghttp2	linux enterprise high performance computing 15-ltss	`1.40.0-3.11.1`	fixed
Suse	nghttp2	linux enterprise high performance computing 15 sp1-espos	`1.40.0-3.11.1`	fixed
Suse	nghttp2	linux enterprise high performance computing 15 sp1-ltss	`1.40.0-3.11.1`	fixed
Suse	nghttp2	linux enterprise server 15-ltss	`1.40.0-3.11.1`	fixed
Suse	nghttp2	linux enterprise server 15 sp1-bcl	`1.40.0-3.11.1`	fixed
Suse	nghttp2	linux enterprise server 15 sp1-ltss	`1.40.0-3.11.1`	fixed
Suse	nghttp2	linux enterprise server for sap applications 15	`1.40.0-3.11.1`	fixed
Suse	nghttp2	linux enterprise server for sap applications 15 sp1	`1.40.0-3.11.1`	fixed
Suse	nghttp2	manager proxy 4.0	`1.40.0-3.11.1`	fixed
Suse	nghttp2	manager retail branch server 4.0	`1.40.0-3.11.1`	fixed
Suse	nghttp2	manager server 4.0	`1.40.0-3.11.1`	fixed
Suse	nghttp2	enterprise storage 6	`1.40.0-3.11.1`	fixed
Opensuse	nodejs14	tumbleweed	`14.17.5-1.2`	fixed
Suse	nodejs8	linux enterprise module for web and scripting 15 sp2	`8.17.0-10.3.1`	fixed
Suse	nghttp2	linux enterprise module for basesystem 15 sp2	`1.40.0-3.5.1`	fixed
Suse	nghttp2	linux enterprise micro 5.0	`1.40.0-3.5.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	nodejs	source	sid	`10.21.0~dfsg-1`	not yet assigned	Not reported	[962145]
Debian	nodejs	source	forky	`10.21.0~dfsg-1`	not yet assigned	Not reported	[962145]
Debian	nodejs	source	trixie	`10.21.0~dfsg-1`	not yet assigned	Not reported	[962145]
Debian	nodejs	source	bookworm	`10.21.0~dfsg-1`	not yet assigned	Not reported	[962145]
Debian	nghttp2	source	sid	`1.41.0-1`	not yet assigned	Not reported	Not reported
Debian	nghttp2	source	forky	`1.41.0-1`	not yet assigned	Not reported	Not reported
Debian	nghttp2	source	trixie	`1.41.0-1`	not yet assigned	Not reported	Not reported
Debian	nghttp2	source	bookworm	`1.41.0-1`	not yet assigned	Not reported	Not reported
Alpine	nghttp2	apk	3.10	`1.39.2-r1`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.11	`1.40.0-r1`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.12	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.13	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.14	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.15	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.16	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.17	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.18	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.19	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.20	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.21	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.22	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.23	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.24	`1.41.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nghttp2	apk	3.9	`1.35.1-r2`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.11	`12.20.1-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.12	`12.18.3-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.13	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.14	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.15	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.16	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.17	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.18	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.19	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.20	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.21	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.22	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.23	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Alpine	nodejs	apk	3.24	`12.18.0-r0`	Not reported	ALPINE-CVE-2020-11080	Not reported
Ubuntu	nghttp2	deb	pro	`1.30.0-1ubuntu1+esm1`	Not reported	USN-6142-1	Not reported
Ubuntu	nghttp2	deb	20.04	`1.40.0-1ubuntu0.1`	Not reported	USN-6142-1	Not reported
Ubuntu	nghttp2	deb	pro	`1.30.0-1ubuntu1+esm1`	Not reported	UBUNTU-CVE-2020-11080	Not reported
Ubuntu	nghttp2	deb	20.04	`1.40.0-1ubuntu0.1`	Not reported	UBUNTU-CVE-2020-11080	Not reported
Opensuse	nodejs8	rpm	leap 15.1	`8.17.0-lp151.2.15.1`	Not reported	OPENSUSE-SU-2020:0802-1	Not reported
Suse	nodejs8	rpm	linux enterprise module for web and scripting 15 sp1	`8.17.0-3.32.1`	Not reported	SUSE-SU-2020:1576-1	Not reported
Suse	nodejs8	rpm	linux enterprise high performance computing 15-espos	`8.17.0-3.32.1`	Not reported	SUSE-SU-2020:1576-1	Not reported
Suse	nodejs8	rpm	linux enterprise high performance computing 15-ltss	`8.17.0-3.32.1`	Not reported	SUSE-SU-2020:1576-1	Not reported
Suse	nodejs8	rpm	linux enterprise server 15-ltss	`8.17.0-3.32.1`	Not reported	SUSE-SU-2020:1576-1	Not reported
Suse	nodejs8	rpm	linux enterprise server for sap applications 15	`8.17.0-3.32.1`	Not reported	SUSE-SU-2020:1576-1	Not reported
Suse	nodejs12	rpm	linux enterprise module for web and scripting 12	`12.18.0-1.14.1`	Not reported	SUSE-SU-2020:1606-1	Not reported
Opensuse	nghttp2	rpm	leap 15.2	`1.40.0-lp152.2.6.1`	Not reported	OPENSUSE-SU-2021:0468-1	Not reported
Opensuse	nghttp2-python	rpm	leap 15.2	`1.40.0-lp152.2.6.1`	Not reported	OPENSUSE-SU-2021:0468-1	Not reported
Suse	nghttp2	rpm	linux enterprise high performance computing 15-espos	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	linux enterprise high performance computing 15-ltss	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	linux enterprise high performance computing 15 sp1-espos	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	linux enterprise high performance computing 15 sp1-ltss	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	linux enterprise server 15-ltss	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	linux enterprise server 15 sp1-bcl	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	linux enterprise server 15 sp1-ltss	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	linux enterprise server for sap applications 15	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	linux enterprise server for sap applications 15 sp1	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	manager proxy 4.0	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	manager retail branch server 4.0	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	manager server 4.0	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Suse	nghttp2	rpm	enterprise storage 6	`1.40.0-3.11.1`	Not reported	SUSE-SU-2021:0931-1	Not reported
Opensuse	nodejs14	rpm	tumbleweed	`14.17.5-1.2`	Not reported	OPENSUSE-SU-2024:11096-1	Not reported
Suse	nodejs8	rpm	linux enterprise module for web and scripting 15 sp2	`8.17.0-10.3.1`	Not reported	SUSE-SU-2020:2800-1	Not reported
Suse	nghttp2	rpm	linux enterprise module for basesystem 15 sp2	`1.40.0-3.5.1`	Not reported	SUSE-SU-2021:0930-1	Not reported
Suse	nghttp2	rpm	linux enterprise micro 5.0	`1.40.0-3.5.1`	Not reported	SUSE-SU-2021:0930-1	Not reported

[Debian bug #962145]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libnghttp2-14]Unknown
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
[libnghttp2-dev]Unknown
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
[libnghttp2-doc]Unknown
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
[libnode108]Unknown
Source package: [nodejs]
Details (4)
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
[libnode-dev]Unknown
Source package: [nodejs]
Details (4)
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
[nghttp2]Unknown
Details (4)
- 1.52.0-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
[nghttp2-client]Unknown
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
[nghttp2-proxy]Unknown
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
[nghttp2-server]Unknown
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
- 1.52.0-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12
[nodejs]Unknown
Details (4)
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
[nodejs-doc]Unknown
Source package: [nodejs]
Details (4)
- 18.20.4+dfsg-1~deb12u2 · all · bookworm
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · all · bookworm
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

[Debian 13 (Trixie)]

[libnghttp2-14]Unknown
Source package: [nghttp2]
Details (4)
- 1.64.0-1.1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
[libnghttp2-dev]Unknown
Source package: [nghttp2]
Details (4)
- 1.64.0-1.1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
[libnghttp2-doc]Unknown
Source package: [nghttp2]
Details (4)
- 1.64.0-1.1+deb13u1 · all · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · all · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
[libnode115]Unknown
Source package: [nodejs]
Details (5)
- 20.19.2+dfsg-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · 13
- 20.19.2+dfsg-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · 13
- 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · 13
- 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · 13
- 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · 13
[libnode-dev]Unknown
Source package: [nodejs]
Details (5)
- 20.19.2+dfsg-1+deb13u2 · amd64 · trixie
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · 13
- 20.19.2+dfsg-1+deb13u2 · arm64 · trixie
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · 13
- 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · 13
- 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · 13
- 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 10.21.0~dfsg-1
  dsa · nodejs · debian · 13
[nghttp2]Unknown
Details (4)
- 1.64.0-1.1+deb13u1 · all · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · all · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
[nghttp2-client]Unknown
Source package: [nghttp2]
Details (4)
- 1.64.0-1.1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
[nghttp2-proxy]Unknown
Source package: [nghttp2]
Details (4)
- 1.64.0-1.1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
[nghttp2-server]Unknown
Source package: [nghttp2]
Details (4)
- 1.64.0-1.1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13
- 1.64.0-1.1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.41.0-1
  dsa · nghttp2 · debian · 13

Next results

Observed: Oct 23, 2026, 5:46:51 PM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]