CVE-2024-22019

A vulnerability in Node.js HTTP servers allows an attacker to send a
specially crafted HTTP request with chunked encoding, leading to resource
exhaustion and denial of service (DoS). The server reads an unbounded
number of bytes from a single connection, exploiting the lack of
limitations on chunk extension bytes. The issue can cause CPU and network
bandwidth exhaustion, bypassing standard safeguards like timeouts and body
size limits.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1064055&gt;