AZL-35909 CVE-2024-22025 affecting package nodejs for versions less than 16.20.2-4

🗓️ 19 Mar 2024 05:15:10Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Node.js fetch() decodes Brotli, causing memory exhaustion DoS from untrusted URLs in versions below 16.20.2-4.

Reporter	Title	Published	Views	Family All 205
IBM Security Bulletins	Security Bulletin: Node.js vulnerabilities affect IBM Spectrum Control	8 Jul 202409:24	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Voice Gateway	1 Apr 202418:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	19 Mar 202417:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to denial of service [CVE-2024-22025]	5 Jun 202414:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.15 and earlier	19 Mar 202420:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js.	10 May 202414:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	15 Apr 202502:40	–	ibm
FreeBSD	NodeJS -- Vulnerabilities	14 Feb 202400:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-544)	6 Mar 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2024-568)	21 Mar 202400:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-22025

21 Apr 2026 04:25Current

6.8Medium risk

Vulners AI Score6.8

CVSS 36.5

EPSS0.00636

SSVC