Node.js HTTP Server Chunked Encoding DoS via Unbounded Chunk Extension
CVE-2024-22019 Published on February 20, 2024
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
Weakness Type
Improper Resource Shutdown or Release
The program does not release or incorrectly releases a resource before it is made available for re-use. When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
Products Associated with CVE-2024-22019
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-22019 are published in these products:
Affected Versions
NodeJS Node:- Version 4.0 and below 4.* is affected.
- Version 5.0 and below 5.* is affected.
- Version 6.0 and below 6.* is affected.
- Version 7.0 and below 7.* is affected.
- Version 8.0 and below 8.* is affected.
- Version 9.0 and below 9.* is affected.
- Version 10.0 and below 10.* is affected.
- Version 11.0 and below 11.* is affected.
- Version 12.0 and below 12.* is affected.
- Version 13.0 and below 13.* is affected.
- Version 14.0 and below 14.* is affected.
- Version 15.0 and below 15.* is affected.
- Version 16.0 and below 16.* is affected.
- Version 17.0 and below 17.* is affected.
- Version 18.0 and below 18.19.1 is affected.
- Version 19.0 and below 19.* is affected.
- Version 20.0 and below 20.11.1 is affected.
- Version 21.0 and below 21.6.2 is affected.
- Before and including 21.6.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.