A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding,
leading to resource exhaustion and denial of service (DoS).
The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes.
The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.
Impacts:
Thank you, to Bartek Nowotarski for reporting this vulnerability and thank you Paolo Insogna
for fixing it.
This Cyber News was published on www.tenable.com. Publication date: Thu, 15 Feb 2024 04:46:04 +0000