7.5

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-22019

CVE-2024-22019: A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP...

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-22019

CVE-2024-22019:

7.5

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2024-22019) lies in Node.js's HTTP server's handling of chunked encoding, specifically the unbounded processing of chunk extension bytes. The Node.js security advisory and commit history indicate that this was fixed by updating the vendored llhttp library to version 9.2.0 (commit a8f0da691adb178cc1465a5a59347fdafd3d2e3c in nodejs/node).

The core parsing logic is within llhttp.c, and the main entry point for this parsing is the llhttp_execute function. This function manages the state machine that parses the HTTP stream. The vulnerability was that this state machine, in versions prior to llhttp 9.2.0, did not properly limit the number of bytes consumed for chunk extensions.

In the Node.js C++ codebase, src/node_http_parser.cc contains the HTTPParser class, whose Execute method calls llhttp_execute. Thus, HTTPParser::Execute is a direct caller of the vulnerable C code and would appear in a runtime profile during exploitation.

The evidence is the commit updating llhttp and the description of the vulnerability which pinpoints the issue to the parsing of chunk extensions within the HTTP parser.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.