CVE-2021-28092: Regular Expression Denial of Service (ReDoS) in is-svg package
Summary
CVE-2021-28092: Regular Expression Denial of Service (ReDoS). Affects is-svg versions >= 2.1.0, < 4.2.2. Fixed in 4.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The is-svg package is a Node.js package used for determining whether a given string represents an SVG image. It provides a function called isSvg that takes a string as input and checks if it is a valid SVG image. The package is commonly used in Node.js applications that deal with SVG images.
Vulnerability Detail
The is-svg package versions 2.1.0 through 4.2.1 are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This vulnerability arises from the use of a regular expression that can be exploited by an attacker to cause the package to hang indefinitely when processing a malicious string. This can lead to a denial of service (DoS) condition, where the application becomes unresponsive and unavailable to legitimate users.
How To Fix
Minimum fixed version
4.2.2
This is the first release that contains the fix.
npm install is-svg@4.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of is-svg is not immediately feasible, a possible workaround is to implement input validation and sanitization in the application code. By carefully validating and sanitizing user input before passing it to the isSvg function, the risk of triggering the ReDoS vulnerability can be reduced. Here is an example of how input validation can be implemented in JavaScript:
const isSvg = require('is-svg');
function validateSvg(input) {
// Perform input validation and sanitization
if (typeof input !== 'string') {
throw new Error('Invalid input');
}
// Call isSvg function with sanitized input
return isSvg(input);
}
Conclusion
The is-svg package versions 2.1.0 through 4.2.1 for Node.js are vulnerable to Regular Expression Denial of Service (ReDoS). It is recommended to upgrade to version 4.2.2 or later to fix this vulnerability. If immediate upgrade is not possible, implementing input validation and sanitization can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for is-svg →
FAQ
The is-svg package is a Node.js package used for determining whether a given string represents an SVG image. It provides a function called isSvg that takes a string as input and checks if it is a valid SVG image.
Regular Expression Denial of Service (ReDoS) is a type of vulnerability that arises when a regular expression pattern can be exploited by an attacker to cause the application to hang or consume excessive resources when processing certain input strings.
The vulnerability in the is-svg package can be exploited by an attacker to cause a denial of service (DoS) condition. This can lead to the application becoming unresponsive and unavailable to legitimate users.
To fix this vulnerability, it is recommended to upgrade to is-svg version 4.2.2 or later. This version includes a fix for the regular expression that mitigates the ReDoS vulnerability.
If upgrading to the latest version of is-svg is not immediately feasible, a possible workaround is to implement input validation and sanitization in the application code to reduce the risk of triggering the ReDoS vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for is-svg.
