A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-22019
• https://hackerone.com/reports/2233486
• https://security.netapp.com/advisory/ntap-20240315-0004
• http://www.openwall.com/lists/oss-security/2024/03/11/1