CVE-2024-22019

moderate-risk
Published 2024-02-20

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

Do I need to act?

-
0.38% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (3)

Affected Vendors

Netapp Nodejs

References (7)

Mailing List http://www.openwall.com/lists/oss-security/2024/03/11/1
Issue Tracking https://hackerone.com/reports/2233486
Third Party Advisory https://security.netapp.com/advisory/ntap-20240315-0004/
Mailing List http://www.openwall.com/lists/oss-security/2024/03/11/1
Issue Tracking https://hackerone.com/reports/2233486
https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20240315-0004/
36
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 1/34 · Minimal
Exposure 9/34 · Low