Is CVE-2024-22019 in the CISA KEV catalog?

No. CVE-2024-22019 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2024-22019?

CVE-2024-22019 has a CVSS v3 base score of 7.5 (HIGH).

What is the EPSS score for CVE-2024-22019?

CVE-2024-22019 has an EPSS score of 3.17% (87th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2024-22019?

Upgrade nodejs on debian 11 to 12.22.12~dfsg-1~deb11u5 or later. Fixes are available for 39 affected products.

CVE & CISA-KEV Catalog

CVE-2024-22019

HIGHEPSS 87th pctl

7.5

CVSS v3

NVD

Description

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

CWE-404

How to fix

Remediation Available

nodejsDebian

Fixed in:12.22.12~dfsg-1~deb11u5CVE-2024-22019

Fixed in:18.20.4+dfsg-1~deb12u1CVE-2024-22019

Fixed in:18.19.1+dfsg-1CVE-2024-22019

nodejsRocky

Fixed in:1:16.20.2-4.module+el8.6.0+21547+94389150.ppc64le::nodejs:16RHSA-2024:2793

Fixed in:1:16.20.2-4.module+el8.6.0+21547+94389150.s390x::nodejs:16RHSA-2024:2793

Fixed in:1:16.20.2-4.module+el8.6.0+21547+94389150.x86_64::nodejs:16RHSA-2024:2793

Fixed in:1:16.20.2-4.module+el8.9.0+21536+8fdee1fb.ppc64le::nodejs:16RHSA-2024:1444

Fixed in:1:18.19.1-1.module+el8.8.0+21592+14a8b93e.x86_64::nodejs:18RHSA-2024:1880

Fixed in:1:18.19.1-1.module+el8.8.0+21592+14a8b93e.aarch64::nodejs:18RHSA-2024:1880

Fixed in:1:18.19.1-1.module+el8.8.0+21592+14a8b93e.s390x::nodejs:18RHSA-2024:1880

Fixed in:1:18.19.1-1.module+el8.8.0+21592+14a8b93e.ppc64le::nodejs:18RHSA-2024:1880

Fixed in:1:18.19.1-1.module+el8.9.0+21387+21356dec.src::nodejs:18RHSA-2024:1510

Fixed in:1:18.19.1-1.module+el9.2.0+21594+a052107e.aarch64::nodejs:18RHSA-2024:1932

Fixed in:1:16.20.2-4.module+el8.9.0+21536+8fdee1fb.s390x::nodejs:16RHSA-2024:1444

Fixed in:1:16.20.2-4.module+el8.9.0+21536+8fdee1fb.x86_64::nodejs:16RHSA-2024:1444

Fixed in:1:18.19.1-1.module+el9.2.0+21594+a052107e.src::nodejs:18RHSA-2024:1932

Fixed in:1:18.19.1-1.module+el8.9.0+21387+21356dec.aarch64::nodejs:18RHSA-2024:1510

Fixed in:1:18.19.1-1.module+el9.2.0+21594+a052107e.x86_64::nodejs:18RHSA-2024:1932

Fixed in:1:16.20.2-4.module+el8.9.0+21536+8fdee1fb.src::nodejs:16RHSA-2024:1444

Fixed in:1:16.20.2-4.module+el8.9.0+21536+8fdee1fb.aarch64::nodejs:16RHSA-2024:1444

Fixed in:1:16.20.2-4.module+el8.8.0+21546+ecd4bb56.src::nodejs:16RHSA-2024:2651

Fixed in:1:20.11.1-1.module+el9.3.0+21385+bac43d5a.src::nodejs:20RHSA-2024:1688

Fixed in:1:20.11.1-1.module+el9.3.0+21385+bac43d5a.aarch64::nodejs:20RHSA-2024:1688

Fixed in:1:16.20.2-4.module+el8.8.0+21546+ecd4bb56.aarch64::nodejs:16RHSA-2024:2651

Fixed in:1:18.19.1-1.module+el9.3.0+21388+22892fb9.x86_64::nodejs:18RHSA-2024:1503

Fixed in:1:18.19.1-1.module+el9.3.0+21388+22892fb9.s390x::nodejs:18RHSA-2024:1503

Fixed in:1:20.11.1-1.module+el9.3.0+21385+bac43d5a.ppc64le::nodejs:20RHSA-2024:1688

Fixed in:1:16.20.2-4.module+el8.8.0+21546+ecd4bb56.ppc64le::nodejs:16RHSA-2024:2651

Fixed in:1:18.19.1-1.module+el9.3.0+21388+22892fb9.ppc64le::nodejs:18RHSA-2024:1503

Fixed in:1:20.11.1-1.module+el9.3.0+21385+bac43d5a.s390x::nodejs:20RHSA-2024:1688

Fixed in:1:18.19.1-1.module+el9.3.0+21388+22892fb9.aarch64::nodejs:18RHSA-2024:1503

Fixed in:1:16.20.2-4.module+el8.8.0+21546+ecd4bb56.s390x::nodejs:16RHSA-2024:2651

Fixed in:1:20.11.1-1.module+el9.3.0+21385+bac43d5a.x86_64::nodejs:20RHSA-2024:1688

Fixed in:1:18.19.1-1.module+el8.9.0+21387+21356dec.x86_64::nodejs:18RHSA-2024:1510

Fixed in:1:16.20.2-4.module+el8.8.0+21546+ecd4bb56.x86_64::nodejs:16RHSA-2024:2651

Fixed in:1:18.19.1-1.module+el9.3.0+21388+22892fb9.src::nodejs:18RHSA-2024:1503

Fixed in:1:18.19.1-1.module+el9.2.0+21594+a052107e.s390x::nodejs:18RHSA-2024:1932

Fixed in:1:18.19.1-1.module+el8.9.0+21387+21356dec.ppc64le::nodejs:18RHSA-2024:1510

Fixed in:1:20.11.1-1.module+el8.9.0+21380+12032667.src::nodejs:20RHSA-2024:1687

Fixed in:1:20.11.1-1.module+el8.9.0+21380+12032667.aarch64::nodejs:20RHSA-2024:1687

Fixed in:1:20.11.1-1.module+el8.9.0+21380+12032667.ppc64le::nodejs:20RHSA-2024:1687

Fixed in:1:20.11.1-1.module+el8.9.0+21380+12032667.s390x::nodejs:20RHSA-2024:1687

Fixed in:1:18.19.1-1.module+el8.9.0+21387+21356dec.s390x::nodejs:18RHSA-2024:1510

Fixed in:1:20.11.1-1.module+el8.9.0+21380+12032667.x86_64::nodejs:20RHSA-2024:1687

Fixed in:1:16.20.2-4.module+el8.6.0+21547+94389150.src::nodejs:16RHSA-2024:2793

Fixed in:1:18.19.1-1.module+el9.2.0+21594+a052107e.ppc64le::nodejs:18RHSA-2024:1932

Fixed in:1:16.20.2-4.module+el8.6.0+21547+94389150.aarch64::nodejs:16RHSA-2024:2793

Fixed in:1:18.19.1-1.module+el8.8.0+21592+14a8b93e.src::nodejs:18RHSA-2024:1880

Fixed in:1:16.20.2-4.el9_0RHSA-2024:1424

Fixed in:1:16.20.2-4.el9_3RHSA-2024:1438

Fixed in:1:16.20.2-4.el9_2RHSA-2024:1678

nodejsRed Hat / RHEL