CVE-2024-22025

What it actually does

The fetch() implementation always performs Brotli decompression on responses regardless of trust level, allowing an attacker-controlled server to return a small, highly-compressible payload that expands to gigabytes in memory and exhausts heap resources until the process terminates.

Why it matters to the business

Applications that accept or follow URLs from users can be forced offline, causing service disruption and potential loss of availability for any system relying on the affected Node.js runtime.

How an attack unfolds

An attacker supplies a malicious URL to any code path that invokes fetch() with untrusted input. The server responds with a Brotli-compressed stream engineered for extreme expansion. Node.js decodes the entire payload into memory, triggering resource exhaustion and process termination. No authentication or special privileges are required.

How to fix it

Upgrade to a Node.js release that limits Brotli decompression size or disables automatic decompression for untrusted origins. For AlmaLinux 8 systems also apply the listed package updates: valgrind-1:3.18.1-7.el8 and valgrind-devel-1:3.18.1-7.el8.

How to confirm the fix worked

Confirm the installed Node.js version contains the decompression-size limit fix; test by fetching a known large-compression-ratio Brotli response and verifying that memory usage remains bounded and the process does not terminate.

Typical attack path

1. Locate application code or endpoints that pass user-supplied URLs directly to fetch()
2. Host or compromise a web server returning a Brotli-compressed response with high compression ratio
3. Trigger the fetch call with the attacker-controlled URL
4. Observe memory growth leading to OOM termination or severe performance degradation

How to detect it

Review application and Node.js process logs for sudden memory spikes or OOM killer events immediately following fetch requests to external domains. Correlate web server access logs with process termination timestamps and look for responses containing Brotli content-encoding served to the affected application.

• process terminated by OOM killer after fetch
• Content-Encoding: br responses to Node.js fetch calls
• unusually large heap growth during URL fetch operations

What your security team should do

• Immediately audit all uses of fetch() with external URLs and add explicit size or decompression limits
• Apply the Node.js security update or the AlmaLinux valgrind packages as applicable within the next maintenance window
• Add runtime resource limits and monitoring for Node.js worker processes
• Block or sanitize any user-controlled URLs passed to network fetch functions until patches are deployed