CVE-2024-22025

Name	CVE-2024-22025
Description	A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3776-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nodejs (PTS)	buster	10.24.0~dfsg-1~deb10u1	vulnerable
	buster (security)	10.24.0~dfsg-1~deb10u4	fixed
	bullseye (security), bullseye	12.22.12~dfsg-1~deb11u4	vulnerable
	bookworm	18.13.0+dfsg1-1	vulnerable
	bookworm (security)	18.19.0+dfsg-6~deb12u1	vulnerable
	trixie	18.19.1+dfsg-3	fixed
	sid	18.20.1+dfsg-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nodejs	source	buster	10.24.0~dfsg-1~deb10u4		DLA-3776-1
nodejs	source	(unstable)	18.19.1+dfsg-1

Notes

https://nodejs.org/en/blog/release/v18.19.1
https://github.com/nodejs/node/commit/f31d47e135973746c4f490d5eb635eded8bb3dda (v18.x)
https://github.com/nodejs/node/commit/9052ef43dc2d1b0db340591a9bc9e45a25c01d90 (main)