A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion bypassing standard safeguards like timeouts and body size limits.

🗓️ 26 Feb 2024 08:00:00Reported by MicrosoftType

Node.js HTTP servers have a chunked request flaw that causes DoS via unbounded chunk extensions.

Reporter	Title	Published	Views	Family All 255
IBM Security Bulletins	Security Bulletin: Node.js vulnerabilities affect IBM Spectrum Control	8 Jul 202409:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational® Application Developer for WebSphere® Software is vulnerable to a denial of service	13 May 202423:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Voice Gateway	1 Apr 202418:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality and denial of service due to [CVE-2023-46809] [CVE-2024-21892] [CVE-2024-22019]	23 Apr 202414:05	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service vulnerabilities in Node.js affects IBM Rational Developer for i RPG and COBOL + Modernization Tools, Java Edition	30 May 202418:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	19 Mar 202417:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway is vulnerable to Denial of Service due to use of Node.js	1 Apr 202411:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	29 Aug 202419:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js affect IBM Business Automation Workflow	1 Mar 202419:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.15 and earlier	19 Mar 202420:32	–	ibm