CVE-2017-16113: Regular Expression Denial of Service in parsejson
Summary
CVE-2017-16113: Regular Expression Denial of Service in parsejson. Affects parsejson versions < 0.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The parsejson package is an npm package that provides functionality for parsing JSON data. It is vulnerable to a regular expression denial of service (ReDoS) when parsing untrusted user input. This vulnerability can be exploited to cause a denial of service attack by sending specially crafted input that triggers the ReDoS behavior.
Vulnerability Detail
The vulnerability in parsejson arises from the way it handles regular expressions when parsing user input. By providing input that triggers a ReDoS, an attacker can cause the parsing process to consume excessive amounts of CPU time, leading to a denial of service condition. This can impact the availability of the application or system using parsejson. The vulnerability has been assigned the identifier CVE-2017-16113.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended fix is to replace the usage of parsejson with JSON.parse().
Conclusion
The parsejson package is vulnerable to a regular expression denial of service (ReDoS) when parsing untrusted user input. To mitigate this vulnerability, it is recommended to replace the usage of parsejson with JSON.parse() and ensure proper input validation and sanitization. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for parsejson →
FAQ
The vulnerability can be exploited to cause a denial of service attack by consuming excessive CPU time during the parsing process. This can impact the availability of the application or system using parsejson.
To mitigate the risk, it is recommended to stop using parsejson and switch to the native JSON.parse() function provided by Node.js. Additionally, ensure that user input is properly validated and sanitized to prevent malicious input from triggering ReDoS behavior.
Yes, all versions of parsejson up to and including version 0.0.3 are affected by this vulnerability.
Yes, the recommended fix is to replace the usage of parsejson with JSON.parse() and ensure proper input validation and sanitization.
There are no known public exploits for this vulnerability at the moment.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
