Resource Exhaustion Affecting nodejs-full-i18n package, versions <1:16.20.2-4.el9_3
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL9-NODEJSFULLI18N-6252092
- published 17 Feb 2024
- disclosed 16 Feb 2024
Introduced: 16 Feb 2024
CVE-2024-22019 Open this link in a new tabHow to fix?
Upgrade RHEL:9 nodejs-full-i18n to version 1:16.20.2-4.el9_3 or higher.
This issue was patched in RHSA-2024:1438.
NVD Description
Note: Versions mentioned in the description apply only to the upstream nodejs-full-i18n package and not the nodejs-full-i18n package as distributed by RHEL.
See How to fix? for RHEL:9 relevant fixed versions and status.
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.