CVE-2021-23392: Uncontrolled Resource Consumption in locutus
Summary
CVE-2021-23392: Uncontrolled Resource Consumption in locutus. Affects locutus versions < 2.0.15. Fixed in 2.0.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The locutus package is an npm package that provides JavaScript functions for emulating PHP functions. It allows developers to write PHP functions in JavaScript. The package is widely used in web development projects that require interoperability between PHP and JavaScript. However, versions of locutus before 2.0.15 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack in the gopher_parsedir function.
Vulnerability Detail
The vulnerability in locutus arises from a lack of input validation in the gopher_parsedir function. An attacker can exploit this vulnerability by providing a specially crafted input that triggers a ReDoS attack. This can lead to a denial of service condition, where the application becomes unresponsive or crashes due to excessive CPU usage. The impact of this vulnerability can be severe, as it allows an attacker to disrupt the availability of the affected application.
How To Fix
Latest published version: 3.0.36 as of 23 Oct 2026
npm install locutus@3.0.36Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.15
This is the first release that contains the fix.
npm install locutus@2.0.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the locutus package to the latest version as soon as possible.
Conclusion
The locutus package before version 2.0.15 is vulnerable to a ReDoS attack in the gopher_parsedir function. This can lead to a denial of service condition in the affected application. It is crucial to update the locutus package to version 2.0.15 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for locutus →
FAQ
Locutus is an npm package that provides JavaScript functions for emulating PHP functions.
The vulnerability allows an attacker to perform a ReDoS attack, leading to a denial of service condition in the affected application.
To fix this vulnerability, update the locutus package to version 2.0.15 or later.
There is no known workaround for this vulnerability. It is recommended to update the locutus package to the latest version.
For more information, you can visit the GitHub advisory page at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-39q4-p535-c852/GHSA-39q4-p535-c852.json
References
Related vulnerabilities
Recent vulnerabilities recorded for locutus.
