The vulnerability of the HTTP-server in the Node.js software platform allows attackers to circumvent security restrictions and cause service failures.

🗓️ 10 Apr 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Node.js HTTP server flaw allows unlimited data on one connection with fragmented encoding, enabling remote denial of service.

Reporter	Title	Published	Views	Family All 254
IBM Security Bulletins	Security Bulletin: Node.js vulnerabilities affect IBM Spectrum Control	8 Jul 202409:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational® Application Developer for WebSphere® Software is vulnerable to a denial of service	13 May 202423:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Voice Gateway	1 Apr 202418:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality and denial of service due to [CVE-2023-46809] [CVE-2024-21892] [CVE-2024-22019]	23 Apr 202414:05	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service vulnerabilities in Node.js affects IBM Rational Developer for i RPG and COBOL + Modernization Tools, Java Edition	30 May 202418:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	19 Mar 202417:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway is vulnerable to Denial of Service due to use of Node.js	1 Apr 202411:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	29 Aug 202419:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js affect IBM Business Automation Workflow	1 Mar 202419:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.15 and earlier	19 Mar 202420:32	–	ibm

Vulners

Node

red_hat red_hat_openshift_dataMatch4

red_hat red_hat_software_collections_for_red_hat_enterprise_linuxMatch7

node.js node.jsRange18.0–18.19.1

node.js node.jsRange20.0–20.11.1

node.js node.jsRange21.0–21.6.2

red_hat red_hat_enterprise_linuxMatch8

red_hat red_hat_enterprise_linuxMatch9

Source	Link
hackerone	www.hackerone.com/reports/2233486
security-tracker	www.security-tracker.debian.org/tracker/CVE-2024-22019
access	www.access.redhat.com/security/cve/cve-2024-22019
nodejs	www.nodejs.org/en/blog/vulnerability/february-2024-security-releases
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/3.1/
web	www.web.nvd.nist.gov/view/vuln/detail

04 Mar 2026 00:00Current

7High risk

Vulners AI Score7

CVSS 37.5

CVSS 27.8

EPSS0.03168