Overview
Node.js, a widely used JavaScript runtime built on Chrome's V8 engine, is affected by a medium vulnerability in its HTTP server. A flaw was found in Node.js due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which can allow an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and a denial of service.
Details
Module Info
- Product: Node.js
- Affected versions: <21.6.2, <20.11.1, <v18.19.1, <= 16.20.2, <=v14.21.3, <= v12.22.12
- GitHub repository: https://github.com/nodejs/node
- Fixed in: Node.js NES v12, v14, v16, v18
Vulnerability Info
This vulnerability arises from improper handling of chunk extensions in HTTP requests with Transfer-Encoding: chunked. The server does not adequately limit or reset chunk extensions, allowing an attacker to send excessively large or continuous chunk extensions, potentially leading to denial of service (DoS) or bypassing security controls.
This vulnerability is a serious risk for Node.js applications, requiring immediate attention and patching to prevent exploitation.
Proof Of Concept
A full reproduction:
const server = http.createServer((req, res) => {
req.on('end', () => {
res.writeHead(200, { 'Content-Type': 'text/plain' });
res.end('bye');
});
req.resume();
});
server.listen(0, () => {
const sock = net.connect(server.address().port);
let data = '';
sock.on('data', (chunk) => data += chunk.toString('utf-8'));
sock.on('end', function () {
assert.strictEqual(data, 'HTTP/1.1 413 Payload Too Large\r\nConnection: close\r\n\r\n');
server.close();
});
sock.end('' +
'GET / HTTP/1.1\r\n' +
'Host: localhost:8080\r\n' +
'Transfer-Encoding: chunked\r\n\r\n' +
'2;' + 'A'.repeat(20000) + '=bar\r\nAA\r\n' +
'0\r\n\r\n'
);
});
Credits
- Bartek Nowotarski (finder)
Mitigation
The v16, v14, v12 lines of the Node.js projects are End Of Life and will not receive any updates to address this issue.
Users of the affected components should apply one of the following mitigations:
- Migrate affected applications away to EOL versions.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
