Vulnerability · Published Mar 19, 2024 · Assigned by hackerone
CVE-2024-22025
Medium 6.5
In plain English
A medium-severity security flaw in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)6.5Medium
Exploit odds (30 days)1.3%top 29.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | nodejs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:8 | nodejs-devel | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-devel | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-devel | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-devel | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:8 | nodejs-docs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-docs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-docs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-docs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-docs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:8 | nodejs-full-i18n | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:8 | nodejs-full-i18n | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:9 | nodejs-full-i18n | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-full-i18n | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-libs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 | ALSA-2024:2853 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:2778 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:2779 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 |
| AlmaLinux:8 | npm | 1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | npm | 1:10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | npm | 1:10.5.0-1.20.12.2.2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | npm | 1:10.5.0-1.18.20.2.2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 | ALSA-2024:2910 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DEBIAN-CVE-2024-22025 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DSA-5991-1 |
| Debian:13 | nodejs | 18.19.1+dfsg-1 | DEBIAN-CVE-2024-22025 |
| Debian:14 | nodejs | 18.19.1+dfsg-1 | DEBIAN-CVE-2024-22025 |
| Rocky Linux:8 | nodejs | 1:20.12.2-2.module+el8.9.0+1804+2708cc21 | RLSA-2024:2778 |
| Rocky Linux:8 | nodejs | 1:18.20.2-1.module+el8.9.0+1803+9ac8b495 | RLSA-2024:2780 |
| Rocky Linux:9 | nodejs | 1:16.20.2-8.el9_4 | RLSA-2024:2910 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2780 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2778 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:2779 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2778 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2780 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2853 |
Affected products (as reported)
Weakness: CWE-404 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H