CVE-2024-22019

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-22019
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-22019.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-22019
Aliases
Related
Published
2024-02-20T02:15:50Z
Modified
2024-09-14T20:49:39.480376Z
Summary
[none]
Details

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

References

Affected packages

Debian:11 / nodejs

Package

Name
nodejs
Purl
pkg:deb/debian/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
12.22.12~dfsg-1~deb11u5

Affected versions

12.*

12.21.0~dfsg-5
12.22.4~dfsg-1
12.22.5~dfsg-1
12.22.5~dfsg-2~11u1
12.22.5~dfsg-2
12.22.5~dfsg-3
12.22.5~dfsg-4
12.22.5~dfsg-5
12.22.5~dfsg-6
12.22.5~dfsg-7
12.22.7~dfsg-1
12.22.7~dfsg-2
12.22.9~dfsg-1
12.22.10~dfsg-1
12.22.10~dfsg-2
12.22.12~dfsg-1~deb11u1
12.22.12~dfsg-1~deb11u2
12.22.12~dfsg-1~deb11u3
12.22.12~dfsg-1~deb11u4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / nodejs

Package

Name
nodejs
Purl
pkg:deb/debian/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

18.*

18.13.0+dfsg1-1
18.13.0+dfsg1-1.1
18.19.0+dfsg-1
18.19.0+dfsg-2
18.19.0+dfsg-3
18.19.0+dfsg-4
18.19.0+dfsg-5
18.19.0+dfsg-6~deb12u1
18.19.0+dfsg-6~deb12u2
18.19.0+dfsg-6
18.19.1+dfsg-1
18.19.1+dfsg-2
18.19.1+dfsg-3
18.19.1+dfsg-3.1
18.19.1+dfsg-4
18.19.1+dfsg-6
18.20.1+dfsg-1
18.20.1+dfsg-2
18.20.1+dfsg-3
18.20.1+dfsg-4

20.*

20.10.0+dfsg-1
20.12.2+dfsg-1
20.13.0+dfsg-1
20.13.1+dfsg-1
20.13.1+dfsg-2
20.14.0+dfsg-1
20.14.0+dfsg-2
20.14.0+dfsg-3
20.15.0+dfsg-1
20.15.1+dfsg-1
20.16.0+dfsg-1
20.17.0+dfsg-1
20.17.0+dfsg-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / nodejs

Package

Name
nodejs
Purl
pkg:deb/debian/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.19.1+dfsg-1

Affected versions

18.*

18.13.0+dfsg1-1
18.13.0+dfsg1-1.1
18.19.0+dfsg-1
18.19.0+dfsg-2
18.19.0+dfsg-3
18.19.0+dfsg-4
18.19.0+dfsg-5
18.19.0+dfsg-6~deb12u1
18.19.0+dfsg-6~deb12u2
18.19.0+dfsg-6

Ecosystem specific 

{
    "urgency": "not yet assigned"
}