high 7.5

CVE-2024-22019 json

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resou…

published 2024-02-20 2 y ago modified 2026-09-08 2 mo ago also BIT-node-2024-22019 , BIT-node-min-2024-22019 , EUVD-2024-19625

cvss: 7.5; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.2%; EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits: 0; none known

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

Patch / fix

fixed in 3 distros 7

bitnami node 18.19.1, 20.11.1, 21.6.2
bitnami node-min 18.19.1, 20.11.1, 21.6.2
NodeJS Node 18.19.1, 20.11.1, 21.6.2

debian red hat suse opensuse almalinux rocky linux azure linux

nodejs Debian 12 18.20.4+dfsg-1~deb12u1
nodejs Debian 14, Debian 13 18.19.1+dfsg-1

debian advisories DEBIAN-CVE-2024-22019

npm RHEL 8 1:8.19.4-1.16.20.2.4.module+el8.9.0+21536+8fdee1fb
nodejs RHEL 8 1:16.20.2-4.module+el8.9.0+21536+8fdee1fb
nodejs-nodemon RHEL 8 3.0.1-1.module+el8.9.0+19741+03a9aaff
nodejs-full-i18n RHEL 8 1:16.20.2-4.module+el8.9.0+21536+8fdee1fb
nodejs-packaging RHEL 8 26-1.module+el8.9.0+19858+c237a2cf
npm RHEL 8 1:10.2.4-1.18.19.1.1.module+el8.9.0+21387+21356dec
nodejs RHEL 8 1:18.19.1-1.module+el8.9.0+21387+21356dec
nodejs-nodemon RHEL 8 3.0.1-1.module+el8.9.0+21190+5ebd2c33

red hat advisories RHSA-2024:1444 RHSA-2024:1510 RHSA-2024:1503 RHSA-2024:2793 RHSA-2024:2651 RHSA-2024:1932

nodejs12 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +4 more 12.22.12-150200.4.56.1
nodejs14 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +4 more 14.21.3-150200.15.55.1
nodejs16 SLE Module for Web and Scripting 12 16.20.2-8.39.1
nodejs18 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Web and Scripting 15 SP5 +4 more 18.19.1-150400.9.18.2
nodejs16 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 16.20.2-150300.7.33.1
nodejs16 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +2 more 16.20.2-150400.3.30.1
nodejs18 SLE Module for Web and Scripting 12 18.19.1-8.18.1
nodejs20 SLE Module for Web and Scripting 15 SP5, openSUSE Leap 15.5 20.11.1-150500.11.6.1

suse advisories SUSE-SU-2024:0733-1 SUSE-SU-2024:0732-1 SUSE-SU-2024:0731-1 SUSE-SU-2024:0730-1 SUSE-SU-2024:0729-1 SUSE-SU-2024:0728-1

nodejs20 openSUSE Tumbleweed 20.11.1-1.1
nodejs21 openSUSE Tumbleweed 21.6.2-1.1

opensuse advisories openSUSE-SU-2024:13697-1 openSUSE-SU-2024:13698-1

npm AlmaLinux 8 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35
nodejs AlmaLinux 8 1:20.11.1-1.module_el8.9.0+3775+d8460d35
nodejs-nodemon AlmaLinux 8 3.0.1-1.module_el8.9.0+3731+490e3ce5
nodejs-full-i18n AlmaLinux 8 1:20.11.1-1.module_el8.9.0+3775+d8460d35
nodejs-packaging AlmaLinux 8 2021.06-4.module_el8.9.0+3684+11b9e959
nodejs-packaging-bundler AlmaLinux 8 2021.06-4.module_el8.9.0+3684+11b9e959
npm AlmaLinux 9 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2
nodejs AlmaLinux 9 1:20.11.1-1.module_el9.3.0+88+29afeaa2

almalinux advisories ALSA-2024:1687 ALSA-2024:1688 ALSA-2024:1510 ALSA-2024:1503 ALSA-2024:1438 ALSA-2024:1444

nodejs Rocky Linux 9 1:16.20.2-4.el9_3
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32322+a8b1fd01
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.5.0+31770+0da7192d
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32045+2e5d342d
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32143+ae966e5b
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32144+1d29a396
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32185+bd121a25
nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31770+0da7192d

rocky linux advisories RLSA-2024:1438 RLSA-2024:1688 RLSA-2024:1687 RLSA-2024:1503 RLSA-2024:1444 RLSA-2024:1510

nodejs18 CBL-Mariner 2.0 18.20.2-1
nodejs Azure Linux 3.0 20.14.0-1

azure linux advisories AZL-34461 AZL-35047

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-22019 updated 2026-10-09 cvss 7.5

nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel8
affected: workaround, no fix available
Red Hat Enterprise Linux AppStream (v. 8) nodejs 16.20.2-4.module+el8.9.0+21536+8fdee1fb, nodejs 18.19.1-1.module+el8.9.0+21387+21356dec, nodejs 20.11.1-1.module+el8.9.0+21380+12032667, nodejs-packaging 26-1.module+el8.9.0+19858+c237a2cf, nodejs-nodemon 3.0.1-1.module+el8.9.0+19741+03a9aaff, nodejs-nodemon 3.0.1-1.module+el8.9.0+20473+c4e3d824, +11 more
fixed: vendor fix RHSA-2024:1444
Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.20.2-4.el9_3, nodejs-libs 16.20.2-4.el9_3, npm 8.19.4-1.16.20.2.4.el9_3, nodejs-full-i18n 16.20.2-4.el9_3, nodejs 18.19.1-1.module+el9.3.0+21388+22892fb9, nodejs 20.11.1-1.module+el9.3.0+21385+bac43d5a, +10 more
fixed: vendor fix RHSA-2024:1438
Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs 16.20.2-4.module+el8.6.0+21547+94389150, nodejs-packaging 26-1.module+el8.6.0+19856+c0c87259, nodejs-nodemon 3.0.1-1.module+el8.6.0+19765+366b9144, npm 8.19.4-1.16.20.2.4.module+el8.6.0+21547+94389150, nodejs-full-i18n 16.20.2-4.module+el8.6.0+21547+94389150
fixed: vendor fix RHSA-2024:2793
Red Hat Enterprise Linux AppStream EUS (v.8.8) nodejs 16.20.2-4.module+el8.8.0+21546+ecd4bb56, nodejs 18.19.1-1.module+el8.8.0+21592+14a8b93e, nodejs-packaging 26-1.module+el8.8.0+19857+6d2a104d, nodejs-nodemon 3.0.1-1.module+el8.8.0+19757+8ca87034, nodejs-nodemon 3.0.1-1.module+el8.8.0+19764+7eed1ca3, npm 10.2.4-1.18.19.1.1.module+el8.8.0+21592+14a8b93e, +5 more
fixed: vendor fix RHSA-2024:2651
Red Hat Enterprise Linux AppStream EUS (v.9.0) nodejs 16.20.2-4.el9_0, nodejs-libs 16.20.2-4.el9_0, npm 8.19.4-1.16.20.2.4.el9_0, nodejs-full-i18n 16.20.2-4.el9_0
fixed: vendor fix RHSA-2024:1424
Red Hat Enterprise Linux AppStream EUS (v.9.2) nodejs 16.20.2-4.el9_2, nodejs-libs 16.20.2-4.el9_2, npm 8.19.4-1.16.20.2.4.el9_2, nodejs-full-i18n 16.20.2-4.el9_2, nodejs 18.19.1-1.module+el9.2.0+21594+a052107e, npm 10.2.4-1.18.19.1.1.module+el9.2.0+21594+a052107e, +4 more
fixed: vendor fix RHSA-2024:1678
Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs 14.21.3-6.el7, rh-nodejs14-npm 6.14.18-14.21.3.6.el7, rh-nodejs14-nodejs-full-i18n 14.21.3-6.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs 14.21.3-6.el7, rh-nodejs14-npm 6.14.18-14.21.3.6.el7, rh-nodejs14-nodejs-full-i18n 14.21.3-6.el7
fixed: vendor fix RHSA-2024:1354

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-317-09 updated 2025-11-13 cvss 7.5

Rockwell Automation FactoryTalk Policy Manager

Rockwell Automation FactoryTalk Policy Manager <=6.51.00
affected: mitigation “Rockwell Automation reports this issue is corrected in software Version 6.60.00 and later.” compatibility.rockwellautomation.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-24-319-08 updated 2024-11-12 cvss 7.5

Siemens SINEC INS

Siemens SINEC INS <V1.0_SP2_Update_3
affected: fixed in V1.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-11-07)

Exploit prediction

3.17% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	node	<18.19.1 >=19.0.0, <20.11.1 >=21.0.0, <21.6.2	18.19.1 20.11.1 21.6.2
bitnami	node-min	<18.19.1 >=19.0.0, <20.11.1 >=21.0.0, <21.6.2	18.19.1 20.11.1 21.6.2

Affected products

NodeJS Node
node.js node.js

Classification

Weakness

CWE-404 Improper Resource Shutdown or Release

Technology feeds

Node.js rss critical rss

References

hackerone.com /reports/2233486
issue-tracking, report
security.netapp.com /advisory/ntap-20240315-0004/
third-party-advisory, advisory
openwall.com /lists/oss-security/2024/03/11/1
mailing-list, third-party-advisory, advisory
lists.debian.org /debian-lts-announce/2024/09/msg00029.html
web
nvd.nist.gov /vuln/detail/CVE-2024-22019
web
oracle.com /security-alerts/cpuapr2024.html
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary