CVE-2021-23371: Denial of Service in chrono-node
Summary
CVE-2021-23371: Denial of service in chrono-node. Affects chrono-node versions < 2.2.4. Fixed in 2.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
chrono-node is an npm package that provides date and time manipulation functionalities. It is used to parse, format, and manipulate dates and times in JavaScript applications. The package is vulnerable to a denial of service (DoS) attack due to a hang when processing a date-like string with a large number of embedded spaces.
Vulnerability Detail
The vulnerability in chrono-node allows an attacker to cause a DoS condition by providing a specially crafted date-like string with numerous embedded spaces. When the package encounters such a string, it enters an infinite loop, causing the application to hang indefinitely. This can lead to resource exhaustion and disrupt the normal operation of the affected application. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.2.4
This is the first release that contains the fix.
npm install chrono-node@2.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to the fixed version to mitigate the risk of a DoS attack.
Conclusion
The chrono-node package is vulnerable to a DoS attack due to an infinite loop issue when processing date-like strings with embedded spaces. To mitigate this vulnerability, it is crucial to update the package to version 2.2.4 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for chrono-node →
FAQ
chrono-node is an npm package used for date and time manipulation in JavaScript applications.
The vulnerability allows an attacker to cause a DoS condition, leading to resource exhaustion and disruption of the affected application.
You can fix the vulnerability by updating the chrono-node package to version 2.2.4 or later.
No, there is no known workaround for this vulnerability. Updating the package is the recommended solution.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
