CVE-2017-16099: Regular Expression Denial of Service in no-case
Summary
CVE-2017-16099: Regular Expression Denial of Service in no-case. Affects no-case versions < 2.3.2. Fixed in 2.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The no-case package is an npm package that provides case-insensitive string comparison functions. It is commonly used in JavaScript applications to perform case-insensitive operations on strings. The package allows developers to compare strings without considering their case, making it easier to handle user input or perform string matching. However, versions of no-case prior to 2.3.2 are vulnerable to a regular expression denial of service (ReDoS) attack when parsing untrusted user input.
Vulnerability Detail
The vulnerability in no-case arises from a regular expression used in the package's code. When parsing untrusted user input, the regular expression can be exploited to cause a denial of service by triggering catastrophic backtracking. This can lead to the application becoming unresponsive or consuming excessive CPU resources. An attacker can exploit this vulnerability by providing specially crafted input that triggers the inefficient matching behavior of the regular expression. The impact of this vulnerability can range from a temporary denial of service to a complete system freeze, depending on the resources available to the application.
How To Fix
Minimum fixed version
2.3.2
This is the first release that contains the fix.
npm install no-case@2.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the fixed version of the no-case package is the recommended solution.
Conclusion
The no-case package is vulnerable to a regular expression denial of service (ReDoS) attack when parsing untrusted user input. To mitigate this vulnerability, it is crucial to update the package to version 2.3.2 or later. This update includes a fix for the ReDoS vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for no-case →
FAQ
The no-case package is used for performing case-insensitive string comparisons in JavaScript applications.
A regular expression denial of service (ReDoS) attack is a type of attack where an attacker provides input that causes a regular expression to match in an inefficient manner, leading to a denial of service.
The impact of this vulnerability can range from a temporary denial of service to a complete system freeze, depending on the resources available to the application.
To fix this vulnerability, update the no-case package to version 2.3.2 or later.
There is no known workaround for this vulnerability. Updating to the fixed version of the no-case package is the recommended solution.
