CVE-2021-23346: Regular expression denial of service (ReDoS) in html-parse-stringify

Background

html-parse-stringify is an npm package used for parsing and stringifying HTML. It provides functionality to parse HTML strings into a structured format and convert structured HTML back into a string. This vulnerability affects versions before 2.0.1 of the package html-parse-stringify and all versions of package html-parse-stringify2. The vulnerability arises from a regular expression used for parsing, which can cause the process to freeze when certain input is sent, leading to a denial of service (DoS) condition.

Vulnerability Detail

The vulnerability in html-parse-stringify and html-parse-stringify2 allows an attacker to exploit a regular expression denial of service (ReDoS) issue. By sending specific input, the regular expression used for parsing can backtrack excessively, causing the process to freeze. This can result in a DoS condition, impacting the availability of the affected application. The vulnerability has a CVSS score of 5.3, indicating a moderate severity.

npm install html-parse-stringify@4.0.1

npm install html-parse-stringify@2.0.1

Workaround

If updating the package is not immediately feasible, a temporary workaround can be implemented by validating and sanitizing user input before passing it to the vulnerable parsing function. This can help mitigate the risk of triggering the ReDoS vulnerability. Here is an example of how input validation can be performed in JavaScript:

const input = getUserInput();
if (!/^[a-zA-Z0-9]+$/.test(input)) {
  throw new Error('Invalid input');
}

In this example, the regular expression /^[a-zA-Z0-9]+$/ is used to validate that the input consists only of alphanumeric characters. Adjust the regular expression according to the specific input requirements of your application.

Conclusion

In conclusion, the html-parse-stringify and html-parse-stringify2 packages are vulnerable to a regular expression denial of service (ReDoS) issue. This can be exploited by sending specific input, causing the parsing process to freeze and leading to a denial of service condition. To mitigate this vulnerability, it is recommended to update the affected packages to version 2.0.1 or later. In the meantime, implementing input validation and sanitization can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for html-parse-stringify →

FAQ