# http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

Node.js HTTP server reads unbounded chunk-extension bytes on a single chunked request, exhausting CPU and bandwidth despite timeouts and body-size limits.

- Payout: $3,495
- Severity: high
- Program: Internet Bug Bounty
- Found by: bart
- Disclosed: 2024-03-05
- CVE: CVE-2024-22019
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2375446
- Library page: https://bugbountylibrary.com/r/h1%3A2375446
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:nodejs technique:source-review vuln:dos

**Target:** Node.js http server chunked-encoding parser
**Root cause:** The HTTP parser reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes.
**Steps:**
1. Send a specially crafted HTTP request with chunked transfer encoding to a Node.js http server.
2. Include an oversized/unbounded chunk extension in the chunk header.
3. Server keeps reading the unprocessed extension bytes from the single connection, consuming CPU and network bandwidth.
4. Standard safeguards (timeouts, request body size limits) fail to block it, causing resource exhaustion/DoS.
**Exploitation:** Attacker opens a connection and streams a chunked request whose chunk extension is unbounded; the server reads the unprocessed bytes without limit, exhausting CPU and bandwidth while bypassing timeouts and body-size limits.
**Insight:** Chunk extensions are often parsed but not counted against body-size limits or timeouts; test whether oversized chunk-extension bytes are read unbounded on a single connection.