Denial of Service Vulnerability in Node.js Package: Resource Exhaustion via fetch() Function
Summary
UBUNTU-CVE-2024-22025: A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. Affects nodejs versions 0.10.15~dfsg1-4 – 0.10.25~dfsg2-2ubuntu1.2+esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The package in question, nodejs, provides the core functionality for executing JavaScript on the server. This package is critical for many applications, but it has been found to contain a vulnerability that can lead to Denial of Service (DoS) attacks when improperly handling untrusted URLs.
Vulnerability Detail
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the fetch() function with untrusted URLs. If you must use it, implement strict validation of URLs before passing them to the fetch() function to mitigate the risk of resource exhaustion.
Conclusion
In summary, a significant Denial of Service vulnerability has been identified in the Node.js package, specifically related to the fetch() function. It is crucial for developers to update their Node.js installations to the latest patched versions to mitigate the risk of exploitation. Additionally, implementing strict URL validation can serve as a temporary workaround.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
Affected versions include nodejs 0.10.25, 4.2.6, 8.10.0, 10.19.0, and 12.22.9.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to resource exhaustion, causing the application to crash or become unresponsive.
Yes, you can implement strict validation of URLs before using the fetch() function to avoid passing untrusted URLs.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
