Resource Exhaustion Affecting nodejs:20/nodejs package, versions <1:20.12.2-2.module+el9.4.0+21731+46b5b8a7


Severity

Recommended
high

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.05% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Resource Exhaustion vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL9-NODEJS-7879479
  • published3 Sept 2024
  • disclosed19 Mar 2024

Introduced: 19 Mar 2024

CVE-2024-22025  (opens in a new tab)
CWE-400  (opens in a new tab)

How to fix?

Upgrade RHEL:9 nodejs:20/nodejs to version 1:20.12.2-2.module+el9.4.0+21731+46b5b8a7 or higher.
This issue was patched in RHSA-2024:2853.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs:20/nodejs package and not the nodejs:20/nodejs package as distributed by RHEL. See How to fix? for RHEL:9 relevant fixed versions and status.

A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.

CVSS Scores

version 3.1