DNA View

High Severity Vulnerability

This vulnerability has been rated as High severity. Immediate action is recommended.

CVE-2024-22019

High

Low Medium High Critical

7.5

CVSS Score

Published: Feb 20, 2024

Last Modified: Nov 04, 2025

CWE: CWE-404

Vulnerability Description

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

59 configuration(s) from 2 vendor(s)

astra_control_center

Version:

CPE:

cpe:2.3:a:netapp:astra_control_center:-:*:*:*:*:*:*:*

node.js

Version:

20.4.0

CPE:

cpe:2.3:a:nodejs:node.js:20.4.0:*:*:*:-:*:*:*

node.js

Version:

20.2.0

CPE:

cpe:2.3:a:nodejs:node.js:20.2.0:*:*:*:-:*:*:*

node.js

Version:

18.0.3

CPE:

cpe:2.3:a:nodejs:node.js:18.0.3:*:*:*:-:*:*:*

node.js

Version:

18.0.4

CPE:

cpe:2.3:a:nodejs:node.js:18.0.4:*:*:*:-:*:*:*

node.js

Version:

18.0.6

CPE:

cpe:2.3:a:nodejs:node.js:18.0.6:*:*:*:-:*:*:*

node.js

Version:

18.16.1

CPE:

cpe:2.3:a:nodejs:node.js:18.16.1:*:*:*:lts:*:*:*

node.js

Version:

18.19.0

CPE:

cpe:2.3:a:nodejs:node.js:18.19.0:*:*:*:lts:*:*:*

node.js

Version:

21.2.0

CPE:

cpe:2.3:a:nodejs:node.js:21.2.0:*:*:*:-:*:*:*

node.js

Version:

18.13.0

CPE:

cpe:2.3:a:nodejs:node.js:18.13.0:*:*:*:lts:*:*:*

node.js

Version:

20.6.1

CPE:

cpe:2.3:a:nodejs:node.js:20.6.1:*:*:*:-:*:*:*

node.js

Version:

18.9.0

CPE:

cpe:2.3:a:nodejs:node.js:18.9.0:*:*:*:-:*:*:*

node.js

Version:

20.1.0

CPE:

cpe:2.3:a:nodejs:node.js:20.1.0:*:*:*:-:*:*:*

node.js

Version:

20.11.0

CPE:

cpe:2.3:a:nodejs:node.js:20.11.0:*:*:*:lts:*:*:*

node.js

Version:

18.14.2

CPE:

cpe:2.3:a:nodejs:node.js:18.14.2:*:*:*:lts:*:*:*

node.js

Version:

18.18.2

CPE:

cpe:2.3:a:nodejs:node.js:18.18.2:*:*:*:lts:*:*:*

node.js

Version:

18.5.0

CPE:

cpe:2.3:a:nodejs:node.js:18.5.0:*:*:*:-:*:*:*

node.js

Version:

18.18.1

CPE:

cpe:2.3:a:nodejs:node.js:18.18.1:*:*:*:lts:*:*:*

node.js

Version:

18.14.1

CPE:

cpe:2.3:a:nodejs:node.js:18.14.1:*:*:*:lts:*:*:*

node.js

Version:

18.16.0

CPE:

cpe:2.3:a:nodejs:node.js:18.16.0:*:*:*:lts:*:*:*

node.js

Version:

18.17.1

CPE:

cpe:2.3:a:nodejs:node.js:18.17.1:*:*:*:lts:*:*:*

node.js

Version:

18.3.0

CPE:

cpe:2.3:a:nodejs:node.js:18.3.0:*:*:*:-:*:*:*

node.js

Version:

20.8.1

CPE:

cpe:2.3:a:nodejs:node.js:20.8.1:*:*:*:-:*:*:*

node.js

Version:

21.0.0

CPE:

cpe:2.3:a:nodejs:node.js:21.0.0:*:*:*:-:*:*:*

node.js

Version:

18.17.0

CPE:

cpe:2.3:a:nodejs:node.js:18.17.0:*:*:*:lts:*:*:*

node.js

Version:

18.12.1

CPE:

cpe:2.3:a:nodejs:node.js:18.12.1:*:*:*:lts:*:*:*

node.js

Version:

18.0.1

CPE:

cpe:2.3:a:nodejs:node.js:18.0.1:*:*:*:-:*:*:*

node.js

Version:

20.9.0

CPE:

cpe:2.3:a:nodejs:node.js:20.9.0:*:*:*:lts:*:*:*

node.js

Version:

18.8.0

CPE:

cpe:2.3:a:nodejs:node.js:18.8.0:*:*:*:-:*:*:*

node.js

Version:

18.4.0

CPE:

cpe:2.3:a:nodejs:node.js:18.4.0:*:*:*:-:*:*:*

node.js

Version:

18.0.2

CPE:

cpe:2.3:a:nodejs:node.js:18.0.2:*:*:*:-:*:*:*

node.js

Version:

21.3.0

CPE:

cpe:2.3:a:nodejs:node.js:21.3.0:*:*:*:-:*:*:*

node.js

Version:

18.14.0

CPE:

cpe:2.3:a:nodejs:node.js:18.14.0:*:*:*:lts:*:*:*

node.js

Version:

18.2.0

CPE:

cpe:2.3:a:nodejs:node.js:18.2.0:*:*:*:-:*:*:*

node.js

Version:

18.12.0

CPE:

cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:*

node.js

Version:

18.0.5

CPE:

cpe:2.3:a:nodejs:node.js:18.0.5:*:*:*:-:*:*:*

node.js

Version:

18.18.0

CPE:

cpe:2.3:a:nodejs:node.js:18.18.0:*:*:*:lts:*:*:*

node.js

Version:

20.8.0

CPE:

cpe:2.3:a:nodejs:node.js:20.8.0:*:*:*:-:*:*:*

node.js

Version:

18.6.0

CPE:

cpe:2.3:a:nodejs:node.js:18.6.0:*:*:*:-:*:*:*

node.js

Version:

18.1.0

CPE:

cpe:2.3:a:nodejs:node.js:18.1.0:*:*:*:-:*:*:*

node.js

Version:

21.4.0

CPE:

cpe:2.3:a:nodejs:node.js:21.4.0:*:*:*:-:*:*:*

node.js

Version:

20.0.0

CPE:

cpe:2.3:a:nodejs:node.js:20.0.0:*:*:*:-:*:*:*

node.js

Version:

18.7.0

CPE:

cpe:2.3:a:nodejs:node.js:18.7.0:*:*:*:-:*:*:*

node.js

Version:

20.6.0

CPE:

cpe:2.3:a:nodejs:node.js:20.6.0:*:*:*:-:*:*:*

node.js

Version:

18.11.0

CPE:

cpe:2.3:a:nodejs:node.js:18.11.0:*:*:*:-:*:*:*

node.js

Version:

20.7.0

CPE:

cpe:2.3:a:nodejs:node.js:20.7.0:*:*:*:-:*:*:*

node.js

Version:

20.5.0

CPE:

cpe:2.3:a:nodejs:node.js:20.5.0:*:*:*:-:*:*:*

node.js

Version:

18.0.0

CPE:

cpe:2.3:a:nodejs:node.js:18.0.0:*:*:*:-:*:*:*

node.js

Version:

21.6.1

CPE:

cpe:2.3:a:nodejs:node.js:21.6.1:*:*:*:-:*:*:*

node.js

Version:

21.6.0

CPE:

cpe:2.3:a:nodejs:node.js:21.6.0:*:*:*:-:*:*:*

node.js

Version:

21.5.0

CPE:

cpe:2.3:a:nodejs:node.js:21.5.0:*:*:*:-:*:*:*

node.js

Version:

18.15.0

CPE:

cpe:2.3:a:nodejs:node.js:18.15.0:*:*:*:lts:*:*:*

node.js

Version:

20.10.0

CPE:

cpe:2.3:a:nodejs:node.js:20.10.0:*:*:*:lts:*:*:*

node.js

Version:

18.10.0

CPE:

cpe:2.3:a:nodejs:node.js:18.10.0:*:*:*:-:*:*:*

node.js

Version:

21.1.0

CPE:

cpe:2.3:a:nodejs:node.js:21.1.0:*:*:*:-:*:*:*

node.js

Version:

20.3.0

CPE:

cpe:2.3:a:nodejs:node.js:20.3.0:*:*:*:-:*:*:*

node.js

Version:

18.9.1

CPE:

cpe:2.3:a:nodejs:node.js:18.9.1:*:*:*:-:*:*:*

node.js

Version:

20.5.1

CPE:

cpe:2.3:a:nodejs:node.js:20.5.1:*:*:*:-:*:*:*

node.js

Version:

20.3.1

CPE:

cpe:2.3:a:nodejs:node.js:20.3.1:*:*:*:-:*:*:*

This vulnerability affects 59 software configuration(s). Ensure you patch all affected systems.

Available Security Patches

3 patches available from vendors

View All Patches

Microsoft

2025-Apr-CVE-2024-22019

CVE-2024-22019: None

Severity

Unknown

Released

Oct 01, 2025

Security Update

View Details Vendor Page

Microsoft

2024-Feb-CVE-2024-22019

CVE-2024-22019: A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion bypassing standard safeguards like timeouts and body size limits.

Severity

Unknown

Released

Sep 04, 2025

Security Update

View Details Vendor Page

Oracle

CPUJAN2025

Oracle Critical Patch Update Advisory - January 2025

Severity

Critical

Released

Jan 21, 2025

Restart Required

Security Update

View Details Vendor Page

Browse All Security Patches

References & Resources

Severity Details

7.5

out of 10.0

High

Weakness Type (CWE)

CWE-404

Improper Resource Shutdown or Release

Description: The product does not release or incorrectly releases a resource before it is made available for re-use.
Exploit Likelihood: Medium
Typical Severity: Medium
Abstraction Level: Class