CVE-2024-27922 json
HTTP Handling Vulnerability in the Bare server
published 2024-03-05 2 y ago modified 2026-06-17 4 mo ago also GHSA-86fc-f9gr-v533 , EUVD-2024-0866
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may vary depending on the specific usage of the package but it can potentially affect any system where this package is in use. The problem has been patched in version 2.0.2. As of time of publication, no specific workaround strategies have been disclosed.
Patch / fix
- npm @tomphttp/bare-server-node 2.0.2
- tomphttp tomp_bare_server 2.0.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.82% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @tomphttp/bare-server-node | <2.0.2 |
2.0.2 |
Affected products
- tomphttp bare-server-node
Classification
- Weakness
-
- CWE-444 Inconsistent Interpretation of HTTP Requests
References
-
github.com
/tomphttp/bare-server-node/security/advisories/GHSA-86fc-f9gr-v533
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-27922
advisory
-
github.com
/tomphttp/bare-server-node
package
Sources
- CVE List CVE-2024-27922
- GitHub Advisory GHSA-86fc-f9gr-v533
- NVD CVE-2024-27922
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.