CVE-2024-22019 Denial of service in Node
Attackers can cause denial of service in Node.js HTTP servers by sending crafted chunked requests that exhaust resources, bypassing standard limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22019?
CVE-2024-22019 is a high-severity denial of service vulnerability in Nodejs Node.js, published on 20 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
Weakness: CWE-404
Which versions are affected by CVE-2024-22019?
2 open source packages ship an affected version, including node and node-min. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 18.19.1, 20.11.1, 21.6.2 |
node-min Bitnami | All versions | 18.19.1, 20.11.1, 21.6.2 |
Linux distribution packages (38)
nodejs AlmaLinux:9 | All versions | 1:16.20.2-4.el9_3 |
nodejs-docs AlmaLinux:9 | All versions | 1:16.20.2-4.el9_3 |
nodejs-full-i18n AlmaLinux:9 | All versions | 1:16.20.2-4.el9_3 |
nodejs-libs AlmaLinux:9 | All versions | 1:16.20.2-4.el9_3 |
npm AlmaLinux:9 | All versions | 1:8.19.4-1.16.20.2.4.el9_3 |
nodejs Red Hat:enterprise_linux:9::appstream | All versions | 1:16.20.2-4.el9_3 |
nodejs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:16.20.2-4.el9_3 |
nodejs-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:16.20.2-4.el9_3 |
nodejs-docs Red Hat:enterprise_linux:9::appstream | All versions | 1:16.20.2-4.el9_3 |
nodejs-full-i18n Red Hat:enterprise_linux:9::appstream | All versions | 1:16.20.2-4.el9_3 |
nodejs-libs Red Hat:enterprise_linux:9::appstream | All versions | 1:16.20.2-4.el9_3 |
nodejs-libs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:16.20.2-4.el9_3 |
npm Red Hat:enterprise_linux:9::appstream | All versions | 1:8.19.4-1.16.20.2.4.el9_3 |
nodejs Red Hat:rhel_eus:8.6::appstream | All versions | 1:16.20.2-4.module+el8.6.0+21547+94389150 |
nodejs-debuginfo Red Hat:rhel_eus:8.6::appstream | All versions | 1:16.20.2-4.module+el8.6.0+21547+94389150 |
nodejs-debugsource Red Hat:rhel_eus:8.6::appstream | All versions | 1:16.20.2-4.module+el8.6.0+21547+94389150 |
nodejs-devel Red Hat:rhel_eus:8.6::appstream | All versions | 1:16.20.2-4.module+el8.6.0+21547+94389150 |
nodejs-docs Red Hat:rhel_eus:8.6::appstream | All versions | 1:16.20.2-4.module+el8.6.0+21547+94389150 |
nodejs-full-i18n Red Hat:rhel_eus:8.6::appstream | All versions | 1:16.20.2-4.module+el8.6.0+21547+94389150 |
nodejs-nodemon Red Hat:rhel_eus:8.6::appstream | All versions | 0:3.0.1-1.module+el8.6.0+19765+366b9144 |
nodejs-packaging Red Hat:rhel_eus:8.6::appstream | All versions | 0:26-1.module+el8.6.0+19856+c0c87259 |
npm Red Hat:rhel_eus:8.6::appstream | All versions | 1:8.19.4-1.16.20.2.4.module+el8.6.0+21547+94389150 |
nodejs Red Hat:rhel_eus:8.8::appstream | All versions | 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 |
nodejs-debuginfo Red Hat:rhel_eus:8.8::appstream | All versions | 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 |
nodejs-debugsource Red Hat:rhel_eus:8.8::appstream | All versions | 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 |
nodejs-devel Red Hat:rhel_eus:8.8::appstream | All versions | 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 |
nodejs-docs Red Hat:rhel_eus:8.8::appstream | All versions | 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 |
nodejs-full-i18n Red Hat:rhel_eus:8.8::appstream | All versions | 1:16.20.2-4.module+el8.8.0+21546+ecd4bb56 |
nodejs-nodemon Red Hat:rhel_eus:8.8::appstream | All versions | 0:3.0.1-1.module+el8.8.0+19764+7eed1ca3 |
nodejs-packaging Red Hat:rhel_eus:8.8::appstream | All versions | 0:26-1.module+el8.8.0+19857+6d2a104d |
npm Red Hat:rhel_eus:8.8::appstream | All versions | 1:8.19.4-1.16.20.2.4.module+el8.8.0+21546+ecd4bb56 |
nodejs Red Hat:rhel_eus:9.0::appstream | All versions | 1:16.20.2-4.el9_0 |
nodejs-debuginfo Red Hat:rhel_eus:9.0::appstream | All versions | 1:16.20.2-4.el9_0 |
nodejs-debugsource Red Hat:rhel_eus:9.0::appstream | All versions | 1:16.20.2-4.el9_0 |
nodejs-docs Red Hat:rhel_eus:9.0::appstream | All versions | 1:16.20.2-4.el9_0 |
nodejs-full-i18n Red Hat:rhel_eus:9.0::appstream | All versions | 1:16.20.2-4.el9_0 |
nodejs-libs Red Hat:rhel_eus:9.0::appstream | All versions | 1:16.20.2-4.el9_0 |
nodejs-libs-debuginfo Red Hat:rhel_eus:9.0::appstream | All versions | 1:16.20.2-4.el9_0 |
Products include Netapp Astra Control Center, Nodejs Node.js.
How do I fix CVE-2024-22019?
Upgrade node to a fixed version for your release line: 18.19.1, 20.11.1 or 21.6.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-22019 being exploited?
There is no known exploitation of CVE-2024-22019 in the wild and no public exploit code.
Sources
Also known as ALSA-2024:1438, AZL-34461, AZL-35047, BELL-CVE-2024-22019, BIT-node-2024-22019, BIT-node-min-2024-22019 and 10 more.