Is CVE-2024-27922 actively exploited?

No active exploitation of CVE-2024-27922 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-27922 be exploited remotely?

Yes. CVE-2024-27922 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-27922?

CVE-2024-27922 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2024-27922

CRITICAL

CVE-2024-27922

CWE-444Published: March 21, 2024· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may vary depending on the specific usage of the package but it can potentially affect any system where this package is in use. The problem has been patched in version 2.0.2. As of time of publication, no specific workaround strategies have been disclosed.

NVD Source

Technical Analysis

CVE-2024-27922 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.