# Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash

Node.js HTTP/2 server crashes via assertion failure when CONTINUATION header frames are in flight and the client abruptly closes TCP, racing the Http2Session destructor.

- Payout: $3,645
- Severity: high
- Program: Internet Bug Bounty
- Found by: bart
- Disclosed: 2024-04-29
- CVE: CVE-2024-27983
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2453328
- Library page: https://bugbountylibrary.com/r/h1%3A2453328
- Tags: area:devices domain:network impact:dos kind:bounty platform:hackerone sev:high tech:nodejs technique:race-window vuln:dos vuln:race-condition

**Target:** Node.js HTTP/2 server (nghttp2-backed Http2Session)
**Root cause:** Sending HTTP/2 CONTINUATION header frames then abruptly closing the TCP connection triggers the Http2Session destructor while header frames are still being processed and stored in nghttp2 memory, leaving data behind after reset and causing a race condition that trips an assertion in ~Http2Session().
**Steps:**
1. Open a TCP connection to a Node.js HTTP/2 server.
2. Send HTTP/2 HEADERS followed by CONTINUATION frames so header data is still being processed/stored in nghttp2 memory.
3. Abruptly close the TCP connection from the client while header frames are still in flight.
4. The close triggers the Http2Session destructor concurrently with header processing, hitting the assertion in node::http2::Http2Session::~Http2Session() and crashing the server.
**Exploitation:** Attacker repeatedly sends a few HTTP/2 frames with CONTINUATION headers and abruptly drops the TCP connection, crashing the server and making the HTTP/2 service unavailable.
**Insight:** Race the destructor against in-flight header processing: send CONTINUATION frames and kill the TCP connection mid-processing to leave nghttp2 state inconsistent at teardown.