Fluid Attacks Database

Description

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	nodejs	=12.21.0~dfsg-5 \|\| =12.22.10~dfsg-1 \|\| =12.22.10~dfsg-2 \|\| =12.22.12~dfsg-1~deb11u1 \|\| =12.22.12~dfsg-1~deb11u2 \|\| =12.22.12~dfsg-1~deb11u3 \|\| =12.22.12~dfsg-1~deb11u4 \|\| =12.22.4~dfsg-1 \|\| =12.22.5~dfsg-1 \|\| =12.22.5~dfsg-2 \|\| =12.22.5~dfsg-2~11u1 \|\| =12.22.5~dfsg-3 \|\| =12.22.5~dfsg-4 \|\| =12.22.5~dfsg-5 \|\| =12.22.5~dfsg-6 \|\| =12.22.5~dfsg-7 \|\| =12.22.7~dfsg-1 \|\| =12.22.7~dfsg-2 \|\| =12.22.9~dfsg-1 \|\| >=0 <12.22.12~dfsg-1~deb11u5	12.22.12~dfsg-1~deb11u5
debian 12	nodejs	=18.13.0+dfsg1-1 \|\| =18.13.0+dfsg1-1.1 \|\| =18.19.0+dfsg-1 \|\| =18.19.0+dfsg-2 \|\| =18.19.0+dfsg-3 \|\| =18.19.0+dfsg-4 \|\| =18.19.0+dfsg-5 \|\| =18.19.0+dfsg-6 \|\| =18.19.0+dfsg-6~deb12u1 \|\| =18.19.0+dfsg-6~deb12u2 \|\| =18.19.1+dfsg-1 \|\| =18.19.1+dfsg-2 \|\| =18.19.1+dfsg-3 \|\| =18.19.1+dfsg-3.1 \|\| =18.19.1+dfsg-4 \|\| =18.19.1+dfsg-6 \|\| =18.20.1+dfsg-1 \|\| =18.20.1+dfsg-2 \|\| =18.20.1+dfsg-3 \|\| =18.20.1+dfsg-4 \|\| >=0 <18.20.4+dfsg-1~deb12u1	18.20.4+dfsg-1~deb12u1
debian 13	nodejs	>=0 <18.19.1+dfsg-1	18.19.1+dfsg-1
debian 14	nodejs	>=0 <18.19.1+dfsg-1	18.19.1+dfsg-1
rpm rhel9	nodejs	<1:16.20.2-4.el9_3	1:16.20.2-4.el9_3
rpm rhel8	nodejs	<1:16.20.2-4.module+el8.9.0+21536+8fdee1fb	1:16.20.2-4.module+el8.9.0+21536+8fdee1fb
rpm rhel8.6	nodejs	<1:16.20.2-4.module+el8.6.0+21547+94389150	1:16.20.2-4.module+el8.6.0+21547+94389150
rpm rhel8.8	nodejs	<1:16.20.2-4.module+el8.8.0+21546+ecd4bb56	1:16.20.2-4.module+el8.8.0+21546+ecd4bb56
rpm rhel9.0	nodejs	<1:16.20.2-4.el9_0	1:16.20.2-4.el9_0
rpm rhel9.2	nodejs	<1:16.20.2-4.el9_2	1:16.20.2-4.el9_2

1-10 of 11

Aliases

1. CVE-2024-220192. NVD-2024-220193. OSV-DEBIAN-2024-220194. OSV-2024-220195. GCVE-2024-220196. SECURITY-TRACKER-CVE-2024-220197. lists.debian.org8. https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22019.json9. security.netapp.com

References

1. https://github.com/kos2001/code-shield2. http://www.openwall.com/lists/oss-security/2024/03/11/13. https://hackerone.com/reports/2233486

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.