CVE-2024-22019 is a denial-of-service vulnerability affecting Node.js HTTP servers, including NetApp Astra Control Center. An attacker can exploit this by sending a specially crafted HTTP request using chunked encoding, causing the server to consume excessive resources. With a CVSS score of 7.5 (High), this vulnerability allows unauthenticated attackers to cause CPU and network bandwidth exhaustion without user interaction, bypassing typical safeguards. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 18.0, < 18.19.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 20.0, < 20.11.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 21.0, < 21.6.2CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 18.0.0, < 18.19.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | ||
>= 20.0.0, < 20.11.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
Feb 16, 2024A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion bypassing standard safeguards like timeouts and body size limits.
Feb 13, 2024