A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-full-i18n | Mar 22, 2024 | Feb 20, 2024 |
| Amazon_linux_2023 | — | Upgrade v8-10.2-develUpgrade nodejs-develUpgrade nodejs20-develUpgrade nodejs-docsUpgrade nodejs20-libs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs20-debuginfoUpgrade nodejs20-docsUpgrade nodejs-libsUpgrade nodejs20-debugsourceUpgrade nodejs20-npmUpgrade nodejsUpgrade nodejs20Upgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-npmUpgrade nodejs20-full-i18nUpgrade v8-11.3-develUpgrade nodejs20-libsUpgrade nodejs-debuginfo | Feb 17, 2025 | Feb 16, 2024 |
| Debian | — | Upgrade nodejs | Sep 16, 2024 | Feb 20, 2024 |
| Freebsd | — | Upgrade node18Upgrade node21Upgrade node20Upgrade nodeUpgrade node16 | Mar 2, 2024 | Mar 1, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Feb 20, 2024 |
| Oracle_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-libs | Mar 21, 2024 | Feb 16, 2024 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-libsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debugsource | Mar 20, 2024 | Feb 20, 2024 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debuginfo | Mar 28, 2024 | Feb 20, 2024 |
| Suse | — | Upgrade corepack20Upgrade npm16Upgrade npm14Upgrade nodejs20-develUpgrade corepack18Upgrade nodejs14Upgrade nodejs20Upgrade nodejs16-docsUpgrade nodejs18-develUpgrade nodejs14-develUpgrade nodejs12-docsUpgrade npm12Upgrade nodejs12Upgrade nodejs12-develUpgrade nodejs18Upgrade npm20Upgrade nodejs14-docsUpgrade nodejs16-develUpgrade nodejs16Upgrade npm18Upgrade nodejs18-docsUpgrade nodejs20-docs | Feb 29, 2024 | Feb 20, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub